Splunk Search

timechart only business hours

peter_gianusso
Communicator

I would like to timechart only events that happened between 9 AM and 5 PM...any help would be appreciated

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

If date_hour is available in your data

your search  date_hour>=9 AND date_hour<17 | your timechart command

If date_hour is not present,

your search | eval date_hour=strftime(_time,"%H") | where  date_hour>=9 AND date_hour<17 | your timechart command

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Hi,

You need a where clause using date_hour, and then you'll probably want to increase the bins, or use the bucket command to help show time periods when there isnt data:

 index=_internal | where date_hour>=9 AND date_hour<=17 | timechart count bins=1000

alt text

peter_gianusso
Communicator

thank you!!

0 Karma

somesoni2
Revered Legend

Try something like this

If date_hour is available in your data

your search  date_hour>=9 AND date_hour<17 | your timechart command

If date_hour is not present,

your search | eval date_hour=strftime(_time,"%H") | where  date_hour>=9 AND date_hour<17 | your timechart command

jkat54
SplunkTrust
SplunkTrust

if i hadnt taken the screenshot... ;-P, you beat me to it by 25s!

0 Karma

peter_gianusso
Communicator

thank you!!

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...