Splunk Search

event for given time window on each date

PUNSNYC
New Member

I would like to get event count for a particular time period for each day for a given date range (that I will select from search drop down). Time period is between 14:31 hrs and 15:01 hrs for each day.
I am using below query. So two questions: a) can this query be optimized for better performance and b) this query gives me statistics but graph in visualization display all the time and does not adhere to my choosen time window of between 14:31 hrs and 15:01 hrs
index=applogs_01 AND sourcetype=app_pmt
| eval Date=strftime(_time, "%m/%d/%Y")
| where (_time >= strptime(Date." "."14:59","%m/%d/%Y %H:%M") AND _time<=strptime(Date." "."15:01","%m/%d/%Y %H:%M"))
| bin span=1s _time
| stats count by _time

Labels (2)
0 Karma

jotne
Builder

You can do some like this.  It will then only give result between 14:31 (14*60+31=871) and 15:01 (901)

 

your search
| eval Time=date_minute+date_hour*60
| where Time>=871 AND Time<=901

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...