Splunk Search

Restrict timechart to business hours

jmerry_splunk
Splunk Employee
Splunk Employee

I am trying to create a timechart to count data for 7 days during business hours. I have the search working fine my problem is the user does not want to see business hours on the x-axis.

sample
index=_internal|bucket _time span=1h|where date_hour>=8 and date_hour<16 |timechart count by sourcetype
alt text

I do not want to make it continuous since the users assume the connection represents real values. Im looking to only show 8am-4pm each day on the x-axis.

Tags (1)
0 Karma

DalJeanis
Legend

When you say "the user does not want to see business hours", what do you mean?

0 Karma

akocak
Contributor

it doesn't give you exactly what you need. however, representation wise, I believe this is not too far from what you need:

index=_internal 
| bucket _time span=1h 
| where date_hour>=8 and date_hour<16 
| sort date_mday
| eval mhour = date_wday.":".date_hour
| chart count over mhour by sourcetype

You should also note that, timechart command would have its own span and I am not sure how 1h would work in weekly chart.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Yea, timechart will increment dynamically or based on the span attribute in the rendering. But you might have to avoid timechart to avoid the unwanted time periods. Therefore, you're essentially just doing what @akocak described: making a generic chart for which you happen to have the x-axis as time, but Splunk just treats it like an arbitrary value list.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...