Splunk Search
Highlighted

Tabular report showing count based on time range

Path Finder

Hi,

I need to create report in alt text format.
Could anyone help me in achieving this.
I can have time interval of 2 hours as well if cannot have in the format.

0 Karma
Highlighted

Re: Tabular report showing count based on time range

Path Finder

can you provide some input data? i mean with fields

0 Karma
Highlighted

Re: Tabular report showing count based on time range

Path Finder

its just the count of events, my requirement is to show counts based on the time range.

0 Karma
Highlighted

Re: Tabular report showing count based on time range

Legend

@chintanshah, please check out Punchcard Custom Visualization App (https://splunkbase.splunk.com/app/3129/), it will load some examples with `datehourandcount`, which would plot the data as per your need.

alt text




| eval message="Happy Splunking!!!"


Highlighted

Re: Tabular report showing count based on time range

Esteemed Legend

If you just need count, this should be lightning fast:

| tstats count where index=_* BY date_wday date_hour 
| eval date_wday=case(date_wday="sunday"   , "      sunday",
                      date_wday="monday"   , "     monday",
                      date_wday="tuesday"  , "    tuesday",
                      date_wday="wednesday", "   wednesday",
                      date_wday="thursday" , "  thursday",
                      date_wday="friday"   , " friday",
                      true(), date_wday)
| chart first(count) OVER date_hour BY date_wday
| addtotals row=t col=t
| eval date_hour=if(date_hour>23, "TOTAL", date_hour)
0 Karma