Splunk Search

event for given time window on each date

PUNSNYC
New Member

I would like to get event count for a particular time period for each day for a given date range (that I will select from search drop down). Time period is between 14:31 hrs and 15:01 hrs for each day.
I am using below query. So two questions: a) can this query be optimized for better performance and b) this query gives me statistics but graph in visualization display all the time and does not adhere to my choosen time window of between 14:31 hrs and 15:01 hrs
index=applogs_01 AND sourcetype=app_pmt
| eval Date=strftime(_time, "%m/%d/%Y")
| where (_time >= strptime(Date." "."14:59","%m/%d/%Y %H:%M") AND _time<=strptime(Date." "."15:01","%m/%d/%Y %H:%M"))
| bin span=1s _time
| stats count by _time

Labels (2)
0 Karma

jotne
Builder

You can do some like this.  It will then only give result between 14:31 (14*60+31=871) and 15:01 (901)

 

your search
| eval Time=date_minute+date_hour*60
| where Time>=871 AND Time<=901

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...