Dear Splunkers,
running version 9.3.1 and I would like to perform a search in which I would like to identify what are the most common hours trucks have been visiting my site location.
My search query is following:
| addinfo
| eval _time = strptime(Start_time,"%m/%d/%Y %H:%M")
| addinfo
| where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity")
| search Plate!=0
| search Location="*"
| timechart span=1h count by Plate limit=50
Like this Im able see trucks visiting location by time in a span.
How to continue to display what are the most common hours during which my trucks visiting locations.
Thank you
