Splunk Search

How to put working hours from each user by day in a time chart

rens78
New Member

My search so far:

index=notimportant EventID=4624 [ inputlookup users.csv | fields TargetUserName ]  | chart eval(latest(_time) - earliest(_time)) as total by TargetUserName | fieldformat total=strftime(total, "%H:%M")

What I'm doing is:

Get the earliest event from the result and the latest event from the result (the results are Microsoft login events). Subtracting the logout time from the login time so I get the working times.

Problems:

  • I cannot display times in a time/timechart (when I remove the ":" characters the chart works).

  • When I change the type from chart --> timechart the entry's in the timechart are displayed by the long number notations (not human readable, I forgot the name of this notation).

All I want is the working hours from each user by day, thanks!

0 Karma

DalJeanis
Legend

Try this ...

index=notimportant EventID=4624 [ inputlookup users.csv | fields TargetUserName ] 
| bin _time as myday span=1d
| stats min(_time) as mintime max(_time) as maxtime by TargetUserName myday
| eval TotalHours = round((maxtime-mintime)/3600,2)
| rename mintime as _time
| timechart span=1d  sum(TotalHours) as TotalHours by TargetUserName
0 Karma

rens78
New Member

Awsome!!!!

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...