How to show timechart and timewrap of business hours

[dyapasrikanth]

I am trying to compare count of events with previous days within business hours, here is my query

index=abc
| search "userId:" 
| where date_hour>=9 AND date_hour<=17
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count" 
| timewrap d

I am trying to see the chart data only between 9AM to 5PM, but it is showing data (bar chart) on 24hr scale with blank before 9AM and after 5PM.

How can I adjust the query or time picker to get the desired output ?

[venkatasri]

Hi @dyapasrikanth 

Can you try this,

index=abc earliest=@d+9h latest=@d+17h "userId:" 
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count" 

---

An upvote would be appreciated and accept solution if it helps!

[dyapasrikanth]

This is working fine for one day's data, even my search range is last 7days it is just giving today's data only.

[venkatasri]

Hi @dyapasrikanth 

Can you try this

index=abc "userId:" 
| where date_hour>=9 AND date_hour<=18
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count"

---

An upvote would be appreciated if it helps!

[dyapasrikanth]

It is still giving data from 00:00 to 23:00

[venkatasri]

Hi @dyapasrikanth 

I wish this can be done better, however date_hour i understood its not being extracted by Splunk from _time but actually its from original event FYI. About default fields (host, source, sourcetype, and more) - Splunk Documentation

Following should work, extracted hour from _time. you would find events upto 17:59 as time_hour = 17,  you need to further change this condition using time_min

index=abc "userId:" 
| eval time_hour=strftime(_time, "%H") , time_min=strftime(_time, "%M")
| where time_hour >=9 AND time_hour<=17 
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count"

---

An upvote would be appreciated if it helps!