Splunk Search

Set chart from 12am to 11.59am ? [search queries]

sbnoobbb
Path Finder

I have this search query sourcetype="CurrentWeatherSGMap" Message="Yishun" | eval Description=case(current_summary="Rain", "Poor",current_summary="Thundery Showers","Poor", current_summary="Cloudy", "Fair", current_summary="Partly Cloudy", "Excellent") | chart dc(Description) over _time by Description | eval Poor=if(Description==Poor, "1", "1"). How can I set the chart to display from 12am to 12am time range daily ?

Or can I use advanced xml to display my result ?

Tags (3)
0 Karma
1 Solution

amit_saxena
Communicator

Hi,

I would suggest using the following in your search.

earliest=@d latest=@d+12

let me know if that works for you.

Regards,
Amit Saxena

View solution in original post

0 Karma

amit_saxena
Communicator

Hi,

I would suggest using the following in your search.

earliest=@d latest=@d+12

let me know if that works for you.

Regards,
Amit Saxena

0 Karma

amit_saxena
Communicator

Hi,
Do confirm it the above solution worked for you ?
Regards,
Amit Saxena

0 Karma

linu1988
Champion

You can explicitly define earlest=-1d@d latest=0d@d if only the previous day's data is to be displayed.

Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...