Splunk Search

Time Snapping to the nearest day & Time Charting

marquiselee
Path Finder

I have a script that runs overnight everyday checking for 404 errors against a list of files. Each attempt to access the file is timestamped and marked successful or not_found. The script begins at around 9PM (give or take a couple of hours) and takes 6-8 hours to finish.

The issue I'm having is time charting for a week and beyond.

While the script may have started last night I need to have those results aggregated with the rest of the results and count as "Today's" results.

Is there a way to make the results 'snap' to the closest day?

e/g a 9PM or 11PM result on 1/17 would snap to 1/18 (12:01 AM) on the time chart AND a 3AM or 5 AM result on 1/18 would also snap to 1/18 (12:01 AM) on the time chart.

I hope this description makes sense.

Tags (3)
0 Karma
1 Solution

jonuwz
Influencer

Yes.

If you add 12 hours then round down, you'll snap to the nearest day.

The code would be :

... | eval _time=_time+(12*60*60) | bin _time span=1d | ...

View solution in original post

0 Karma

jonuwz
Influencer

Yes.

If you add 12 hours then round down, you'll snap to the nearest day.

The code would be :

... | eval _time=_time+(12*60*60) | bin _time span=1d | ...

View solution in original post

0 Karma

marquiselee
Path Finder

like a glove! thnx

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!