Splunk Search

## How to search with a fixed time span timechart everyday?

Contributor

I am trying to find my average response time of everyday events (not avg of all the events of that day , but the events from 10AM to 1PM) only for last 7 days.

``````sourcetype="super:access" host=xa20hlf**  | eval headers=split(_raw," ") | eval resp_time=mvindex(headers,10) | eval resptime_time_seconds=resp_time*0.001| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTime
``````
Tags (2)
1 Solution
Legend

Try this...

``````sourcetype="super:access" host=xa20hlf**
| eval Hour=strftime(_time,"%H")
| where Hour>=10 AND Hour<13
| eval resptime_time_seconds=resp_time*0.001
| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTim
``````
Motivator

Hi @zacksoft,

`sourcetype="super:access" host=xa20hlf** earliest=-7d@d latest=now (date_hour=10 OR date_hour=11 OR date_hour=12 OR date_hour=13) | eval headers=split(_raw," ") | eval resp_time=mvindex(headers,10) | eval resptime_time_seconds=resp_time*0.001| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTime`

Contributor

I wanna change the latest = now to latest = (a fix time of day/week, that I choose like this wednesday 6pm) . Also can we exclude weekends?
When we give span=1d, what exactly is the duration of 1d in clockwise?

Legend

Try this...

``````sourcetype="super:access" host=xa20hlf**
| eval Hour=strftime(_time,"%H")
| where Hour>=10 AND Hour<13
| eval resptime_time_seconds=resp_time*0.001
| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTim
``````
Influencer

Dal: In my admittedly limited testing, I found it ~ 8% faster to filter on hour after the timechart. Trim the first eval and the first where, and after timechart add: `| where tonumber(strftime(_time,"%H"))>=10 and tonumber(strftime(_time,"%H"))<13`. My test was a simple count on _internal.

Legend

@twinspop - you can't filter on hour after the `timechart` aggregates to `span=1d` ... so it would not work unless you change the `timechart` to `span=1h` and then run it again through `timechart` to aggregate it up to the day level... and then you are averaging the averages rather than the actual events. If you have an idea that you think will work, please go ahead and write it up as an answer. The more, the merrier!

Influencer

Shoot man, you're totally right. My bad.

Get Updates on the Splunk Community!

#### Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

#### Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

#### Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...