Increment transaction span considering a custom start time

[wagnerbianchi]

Hi Guys,

I'm intending to develop a dashboard that shows what IP addresses have accessed the website every 15 minutes. It's OK, I am planning to use "| timechart span=15m" to solve this question. But, I must start monitoring this scenario from 00:22 AM. Is there a way to start from 00:22 AM and increment every 15 minutes from that time? For example:

2013-08-09 00:22 ...
2013-08-09 00:37 ...
2013-08-09 00:52 ... [...]

Any hint? Thank you guys!

[wagnerbianchi]

The problem I noticed after using "earliest=@d+22m | timechart span=15m" is that the Splunk is rounding the value. For example, when I passed @d+22m as the earliest's parameter, Splunk has listed events from the 00:20 and then, 00:35, 00:50 and so forth...is there a way to increment time from 00:22 and then, 00:37 and so forth? OK, I know that the problem will be in the interval by the way, but, the customer is looking for to start from 00:22...

Thanks a lot for the help.

[aholzer]

earliest=@d+22m
If you add the above to your search terms it will set the start time of your search to midnight+22minutes, or 00:22 AM.
You then apply the timechart that you mentioned and you'll get the bucketing you want. That said you can also use "| bucket _time span=15m" instead of timechart.

-- Edit: Converted to answer --

[aholzer]

In response to your "question in your answer"

I don't think there is an easy way of doing it. You may want to look into the command bucket and it's various options, rather than timechart.

You may also have to get fancy with an eval and a case, to create your own buckets. Use the "date_minute" field that comes with every event and you can do something like:

... | eval buckets=case(
date_minute>=7 AND date_minute<22,"07-22",
date_minute>=22 AND date_minute<37,"22-37",
date_minute>=37 AND date_minute<52,"37-52",
date_minute>=52 OR date_minute<7,"52-07")
Hope this helps

[aholzer]

earliest=@d+22m