Splunk Search

How to add the multiple timelines into one timeline.

RENUKA1
Loves-to-Learn Lots

Hello All,
 I need to convert the Timeline with different times into one.
For example:
12:05AM 12:10AM 12:15AM should be  taken as 12AM
1:05AM 1:10AM 1:15AM should be  taken as 1AM and vice versa.

Can you please help me to write a query for this.

Timeline

Top 10 Values

Count% 
01:10:02 AM20.368%
 
01:20:02 PM20.368%
 
01:30:02 AM20.368%
 
01:35:02 PM20.368%
 
01:45:02 PM20.368%
 
01:50:02 AM20.368%
 
02:05:02 PM20.368%
 
02:10:02 PM20.368%
 
02:40:02 PM20.368%
 
03:05:02 PM





Thank you. 

Labels (1)
Tags (1)
0 Karma

RENUKA1
Loves-to-Learn Lots

@bowesmana  Thanks for help 
but I need the output in AM and PM sequence.Here is my actual output 

01:00:02 AM9.14
01:00:02 PM12.06
01:05:02 AM10.00
01:05:02 PM11.17
01:10:02 AM

 

I except the output to be in first all the AM time should be display and followed by PM

01:00:02 AM9.14
01:00:02 AM12.06
01:05:02 AM10.00
01:05:02 PM11.17
01:10:02 PM
0 Karma

yuanliu
SplunkTrust
SplunkTrust

This is confusing.  The order of output is determined by the order in which your data comes back from index search, not altered by bin command that @bowesmana suggests.  If your data input is not ordered, simply sort your data.

| bin _time span=1h
| sort _time
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use the bin command, e.g.

| bin _time span=1h
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...