Splunk Search

How to add the multiple timelines into one timeline.

RENUKA1
Loves-to-Learn Lots

Hello All,
 I need to convert the Timeline with different times into one.
For example:
12:05AM 12:10AM 12:15AM should be  taken as 12AM
1:05AM 1:10AM 1:15AM should be  taken as 1AM and vice versa.

Can you please help me to write a query for this.

Timeline

Top 10 Values

Count% 
01:10:02 AM20.368%
 
01:20:02 PM20.368%
 
01:30:02 AM20.368%
 
01:35:02 PM20.368%
 
01:45:02 PM20.368%
 
01:50:02 AM20.368%
 
02:05:02 PM20.368%
 
02:10:02 PM20.368%
 
02:40:02 PM20.368%
 
03:05:02 PM





Thank you. 

Labels (1)
Tags (1)
0 Karma

RENUKA1
Loves-to-Learn Lots

@bowesmana  Thanks for help 
but I need the output in AM and PM sequence.Here is my actual output 

01:00:02 AM9.14
01:00:02 PM12.06
01:05:02 AM10.00
01:05:02 PM11.17
01:10:02 AM

 

I except the output to be in first all the AM time should be display and followed by PM

01:00:02 AM9.14
01:00:02 AM12.06
01:05:02 AM10.00
01:05:02 PM11.17
01:10:02 PM
0 Karma

yuanliu
SplunkTrust
SplunkTrust

This is confusing.  The order of output is determined by the order in which your data comes back from index search, not altered by bin command that @bowesmana suggests.  If your data input is not ordered, simply sort your data.

| bin _time span=1h
| sort _time
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use the bin command, e.g.

| bin _time span=1h
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...