Splunk Search

event for given time window on each date

PUNSNYC
New Member

I would like to get event count for a particular time period for each day for a given date range (that I will select from search drop down). Time period is between 14:31 hrs and 15:01 hrs for each day.
I am using below query. So two questions: a) can this query be optimized for better performance and b) this query gives me statistics but graph in visualization display all the time and does not adhere to my choosen time window of between 14:31 hrs and 15:01 hrs
index=applogs_01 AND sourcetype=app_pmt
| eval Date=strftime(_time, "%m/%d/%Y")
| where (_time >= strptime(Date." "."14:59","%m/%d/%Y %H:%M") AND _time<=strptime(Date." "."15:01","%m/%d/%Y %H:%M"))
| bin span=1s _time
| stats count by _time

Labels (2)
0 Karma

jotne
Builder

You can do some like this.  It will then only give result between 14:31 (14*60+31=871) and 15:01 (901)

 

your search
| eval Time=date_minute+date_hour*60
| where Time>=871 AND Time<=901

 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...