Splunk Search

I want to ready value on specific time for last one week

manapuna
New Member

I want to read specific string between 9:15-9:45, each day for last 7 days.

host=manana string | stats dc(count)

Thanks,

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

hey you can try something like this

index=<your_index> date_hour=9 date_minute>=15 date_minute<=44 host=manana string | timechart span=1d count

Run this last seven days and you will get dayswise count from 9:15 to 9:45.
let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

hey you can try something like this

index=<your_index> date_hour=9 date_minute>=15 date_minute<=44 host=manana string | timechart span=1d count

Run this last seven days and you will get dayswise count from 9:15 to 9:45.
let me know if this helps!

0 Karma

FrankVl
Ultra Champion

Assuming your question is about filtering for "between 9:15-9:45", I think you should be able to do that using the date_hour and date_minute fields.

date_hour=9 AND date_minute>=15 AND date_minute<=44
0 Karma

mayurr98
Super Champion

date_minute<=45 will contain data from 9:45:00 to 9:45:59 as well
So it should be date_minute<=44

0 Karma

FrankVl
Ultra Champion

Good catch, let me adjust that in my answer.

0 Karma

horsefez
Motivator

Could you please give us more detail.
I do not know what you are trying to do here.

Do you want do search for events that happen in a specified time-window every day for the last 7 days?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...