Splunk Search

How to show timechart and timewrap of business hours

dyapasrikanth
Path Finder

I am trying to compare count of events with previous days within business hours, here is my query

 

 

index=abc
| search "userId:" 
| where date_hour>=9 AND date_hour<=17
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count" 
| timewrap d

 

 

I am trying to see the chart data only between 9AM to 5PM, but it is showing data (bar chart) on 24hr scale with blank before 9AM and after 5PM.

How can I adjust the query or time picker to get the desired output ?

Labels (2)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @dyapasrikanth 

Can you try this,

index=abc earliest=@d+9h latest=@d+17h "userId:" 
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count" 

---

An upvote would be appreciated and accept solution if it helps!

 

dyapasrikanth
Path Finder

This is working fine for one day's data, even my search range is last 7days it is just giving today's data only.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @dyapasrikanth 

Can you try this

index=abc "userId:" 
| where date_hour>=9 AND date_hour<=18
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count"

---

An upvote would be appreciated if it helps!

dyapasrikanth
Path Finder

It is still giving data from 00:00 to 23:00

dyapasrikanth_0-1624844139894.png

 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @dyapasrikanth 

I wish this can be done better, however date_hour i understood its not being extracted by Splunk from _time but actually its from original event FYI. About default fields (host, source, sourcetype, and more) - Splunk Documentation

Following should work, extracted hour from _time. you would find events upto 17:59 as time_hour = 17,  you need to further change this condition using time_min

 

index=abc "userId:" 
| eval time_hour=strftime(_time, "%H") , time_min=strftime(_time, "%M")
| where time_hour >=9 AND time_hour<=17 
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count"

 

---

An upvote would be appreciated if it helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...