Splunk Search

How to put working hours from each user by day in a time chart

rens78
New Member

My search so far:

index=notimportant EventID=4624 [ inputlookup users.csv | fields TargetUserName ]  | chart eval(latest(_time) - earliest(_time)) as total by TargetUserName | fieldformat total=strftime(total, "%H:%M")

What I'm doing is:

Get the earliest event from the result and the latest event from the result (the results are Microsoft login events). Subtracting the logout time from the login time so I get the working times.

Problems:

  • I cannot display times in a time/timechart (when I remove the ":" characters the chart works).

  • When I change the type from chart --> timechart the entry's in the timechart are displayed by the long number notations (not human readable, I forgot the name of this notation).

All I want is the working hours from each user by day, thanks!

0 Karma

DalJeanis
Legend

Try this ...

index=notimportant EventID=4624 [ inputlookup users.csv | fields TargetUserName ] 
| bin _time as myday span=1d
| stats min(_time) as mintime max(_time) as maxtime by TargetUserName myday
| eval TotalHours = round((maxtime-mintime)/3600,2)
| rename mintime as _time
| timechart span=1d  sum(TotalHours) as TotalHours by TargetUserName
0 Karma

rens78
New Member

Awsome!!!!

0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...