Splunk Search

how to show daily 2pm to 4 pm data for one week

mvaradarajam
Path Finder

Hi All,
how to show daily count of 2pm to 4 pm data for one week
like this i want monday to sunday

monday 2pm =10
monday 3pm
monday 4pm
tuesday 2pm
tuesday 4pm

tuesday 6pm like ths

can u plz help me any one

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi mvaradarajam,

try something like this:

your base search here date_hour>13 AND date_hour<17 | timechart span=1d count by date_wday

hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mvaradarajam,

try something like this:

your base search here date_hour>13 AND date_hour<17 | timechart span=1d count by date_wday

hope this helps ...

cheers, MuS

View solution in original post

0 Karma

mvaradarajam
Path Finder

Hi MuS,

above one also not working showing like below

_time↕

count↕

2014-10-26 16:30:00

3438

2014-10-26 17:30:00

0

2014-10-26 18:30:00

0

2014-10-26 19:30:00

0

2014-10-26 20:30:00

0

2014-10-26 21:30:00

0

2014-10-26 22:30:00

0

2014-10-26 23:30:00

0

2014-10-27 00:30:00

0

0 Karma

MuS
SplunkTrust
SplunkTrust

Why should this not work? You get a result back, so it is working. Maybe you expect something different....So try this, it will 'remove' all empty hours

... date_hour>13 AND date_hour<17 | timechart span=1h count AS myCount | where myCount!="0"
0 Karma

mvaradarajam
Path Finder

HI MuS,

I want day wise 2 to 4 pm data for example
_time count
mon 2pm 10
mon 3pm 15
mon 4pm 20
tue 2pm 5
tue 3pm 15

like this want plz help me how get.............

0 Karma

MuS
SplunkTrust
SplunkTrust

try this:

... date_hour>13 AND date_hour<17 | timechart span=1h count
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!