Splunk Search

how to split the time into different shifts to find how many employees came in shift 1 and shift2

Jyothik
New Member

we have a data with employee numbers who enter the office during different times in the day.

We want to categorize employees coming between 6:30 to 12:30 as Shift1 and 12:31 to 5 PM as Shift 2 and display stats of number of employees coming in Shif1 and Shift2

How to write a query for the same,

Sample Data:
Emp No Time
100 6:30
101 8:00
102 14:00

Regards,
Jyothi

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| eval hourmin=Time
| rex field=hourmin mode=sed "s/://"
| eval Shift=case((hourmin>=630  AND hourmin<1230), "Shift1",
                  (hourmin>=1230 AND hourmin<1700), "Shift2",
                  true(), "N/A")
| stats dc(Emp) BY Shift

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| eval hourmin=Time
| rex field=hourmin mode=sed "s/://"
| eval Shift=case((hourmin>=630  AND hourmin<1230), "Shift1",
                  (hourmin>=1230 AND hourmin<1700), "Shift2",
                  true(), "N/A")
| stats dc(Emp) BY Shift
0 Karma

Jyothik
New Member

thank you woodcock

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...