Splunk Search

Relating data with time

prettysunshinez
Explorer

Hi,
I would like to view today and yesterday data in the same chart for the required time range.

How can that be done.
Help required!
Thanks!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use the timewrap command to do this, e.g.

index=_internal earliest=-4h
| timechart span=1m count 
| timewrap 1h

and it will generate 4 series, one for each hour on the same chart overlayed on top with the x-axis showing the last hour

0 Karma

to4kawa
Ultra Champion

add |where _time > relative_time(now(), "@d+6h") AND _time < relative_time(now(), "@d+12h")

0 Karma

prettysunshinez
Explorer

@to4kawa I would like to view for any specified Time range.
Time range is not fixed

0 Karma

to4kawa
Ultra Champion

make dashboard and token, so use this logic.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...