Splunk Search

Timechart - span=30m show data in 15th and 45th min

askkawalkar
Path Finder

I am trying to create a timechart
base search ...
| timechart span=30m latest(COUNT) as COUNT by NAME

it is providing me events for field "_time" as : "12:00", "12:30", "01:00", "01:30" .. and so on..

I want field "_time" as : "12:15", "12:45", "01:15", "1:45" ... and so on...

Is there any solution to convert _time.

Thanks in advance.

1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @askkawalkar,

This query worked for me. Instead of timechart use below list of evals, stat and chart to achieve your requirement.

<your query>
| bin _time span=15m 
| stats latest(COUNT) as COUNT by _time, NAME
| eval _time=_time/100 
| eval _time=if(_time%2==0,_time-9,_time) 
| eval _time=_time*100 
| chart last(COUNT) as COUNT over _time by NAME

View solution in original post

0 Karma

adonio
Ultra Champion

here is another way of achieving your goal with the aligntime attribute:
read here:
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Bin#Bin_options

run this search anywhere:

| gentimes start=-2 increment=1m
| eval _time = starttime 
| eval number = random()%200
| bin _time span=30m aligntime=@d+15m
| timechart max(number) as max_number

hope it helps

0 Karma

askkawalkar
Path Finder

Hi @adonio ,

Thanks for your help in search anywhere.

Thanks,
Ankush

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@askkawalkar - Did you get chance to check answer?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @askkawalkar,

This query worked for me. Instead of timechart use below list of evals, stat and chart to achieve your requirement.

<your query>
| bin _time span=15m 
| stats latest(COUNT) as COUNT by _time, NAME
| eval _time=_time/100 
| eval _time=if(_time%2==0,_time-9,_time) 
| eval _time=_time*100 
| chart last(COUNT) as COUNT over _time by NAME
0 Karma

askkawalkar
Path Finder

Hi @VatsalJagani ,

Thanks for your quick help. This solution worked for me.

Below is the run anywhere query (@adonio: thanks for providing run anywhere search)

| gentimes start=-2 increment=30m
 | eval _time = starttime 
 | eval number = random()%200
| bin _time span=15m 
 | stats latest(number) as COUNT by _time
 | eval _time=_time/100 
 | eval _time=if(_time%2==0,_time-9,_time) 
 | eval _time=_time*100 
 | chart last(COUNT) as COUNT over _time

Regards,
Ankush

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...