About HWalk1

HWalk1 · ‎04-07-2022

So I am using the below query in a dashboard. I have a time range picker on the dashboard as well. I want the people who use the dash to be able to pick the time and have it be from the NodeTime field rather than splunk's time field. What you're saying is that the data should be onboarded using that field for _time? Or is there a different way to accomplish this? index=*SYSTEM* sourcetype=logactivity host=apac type= "Access granted" portalname=APAC* |dedup personkey |chart dc(personkey)

HWalk1 · ‎04-07-2022

Hi All! The data I am pulling is coming from nodes in multiple time zones. I want to use that time zone instead of Splunk's time field. The correct time data is already being pulled in a NodeTime field but I cannot figure out how to use that field instead of Splunk's time field. Any ideas? TIA for the help!

HWalk1 · ‎03-28-2022

@somesoni2 & @gcusello Thanks! This is exactly what I needed.

HWalk1 · ‎03-28-2022

So I am looking for the number of a specific event (sign-ins) deduped by a user, which is simple. The challenge I am having is that I need the results deduped by date. So if i am looking at a weeks worth of data I would like to see how many sign ins happened each day deduped by user. So, each user would only appear once each day but could appear multiple times over the course of the week depending. Does this make sense? Please let me know if I can clarify anything and thanks in advance for any/all help.

Posts	5
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎03-22-2022

Online Status	Offline
Date Last Visited	‎04-07-2022 08:48 AM

How to use a different field for time?

How to get Dedup results by specific date?

Re: Using a different field for time

How to use a different field for time?

Re: Dedup results by specific date

How to get Dedup results by specific date?