Reporting

How do you set up a time range from 7 pm to 2 pm for a scheduled hourly report?

shaikhussain2
Explorer

We had set up a report which triggers on an hourly basis from 8PM to 2PM (earliest = -1d@d+20h & latest = @d+14h) but we are getting correct reports starting from 12:00 AM only and before that its taking last 24 hours report (9PM, 10PM, 11PM reports).

Thanks,
Shaik Hussain

0 Karma
1 Solution

datasearchninja
Communicator

You need to add some hours into the calculation to shift the base hours into the next day when it is somewhere between 8pm -> midnight

So:
earliest=+4h@d-4h
When it is between midnight and 8pm, this will calculate to 8pm yesterday, after 8pm it will be 8pm today

latest=+4h@d+14h
When it is between midnight and 8pm, this will calculate to 2pm today, after 8pm it will be 2pm tommorrow

View solution in original post

0 Karma

datasearchninja
Communicator

You need to add some hours into the calculation to shift the base hours into the next day when it is somewhere between 8pm -> midnight

So:
earliest=+4h@d-4h
When it is between midnight and 8pm, this will calculate to 8pm yesterday, after 8pm it will be 8pm today

latest=+4h@d+14h
When it is between midnight and 8pm, this will calculate to 2pm today, after 8pm it will be 2pm tommorrow

0 Karma

shaikhussain2
Explorer

Thanks colin, It is working perfectly now and thanks for elaborating the answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...