About Peterm1993

Peterm1993 · ‎11-09-2023

figured it out. thanks for your help. index=analyst reporttype=DepTrayCaseQty Location=DEP/AutoDep* | where OrientationError>0 | table _time OrderId OrientationError * | bin _time span=1h | eval _time=strftime(_time,"%dt%H") | chart sum(OrientationError) as ErrorFrequency over Location by _time useother=f limit=200 | addtotals | sort 0 - Total _time | fields - TOTAL was what i was looking for!

Peterm1993 · ‎11-09-2023

hi @inventsekar I'm trying to convert the results from a daily result to a hourly breakdown so instead of for example and apologies cause I'm very new to splunk 9/11/23 165 errors it would be 1am-2am12 errors 2am-3am 35 errors 3am-4am 12 errors totaling to 165 errors

Peterm1993 · ‎11-09-2023

Hi im trying to convert this search to show totals in hours instead of days/dates can anyone help me please? index=analyst reporttype=DepTrayCaseQty Location=DEP/AutoDep* | where Dimension>0 OR ProtrusionError>0 OR OffCentreError>0 | table _time OrderId ProtrusionError OffCentreError Dimension * | bin _time span=1d | eval _time=strftime(_time,"%d") | eval foo=ProtrusionError+OffCentreError+Dimension | chart sum(foo) as ErrorFrequency over Location by _time useother=f limit=100 | addtotals | sort 0 - Total _time | fields - TOTAL

Posts	3
Solutions	1
Karma Given	2
Karma Received	1
Member Since	‎11-09-2023

Online Status	Offline
Date Last Visited	‎11-09-2023 08:17 PM

converting this search to hours instead of days

Re: converting this search to hours instead of day...

Re: converting this search to hours instead of day...

converting this search to hours instead of days

Are you a member of the Splunk Community?

converting this search to hours instead of days

Re: converting this search to hours instead of day...

Re: converting this search to hours instead of day...

converting this search to hours instead of days