Splunk Search

How to show timechart and timewrap of business hours

dyapasrikanth
Path Finder

I am trying to compare count of events with previous days within business hours, here is my query

 

 

index=abc
| search "userId:" 
| where date_hour>=9 AND date_hour<=17
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count" 
| timewrap d

 

 

I am trying to see the chart data only between 9AM to 5PM, but it is showing data (bar chart) on 24hr scale with blank before 9AM and after 5PM.

How can I adjust the query or time picker to get the desired output ?

Labels (2)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @dyapasrikanth 

Can you try this,

index=abc earliest=@d+9h latest=@d+17h "userId:" 
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count" 

---

An upvote would be appreciated and accept solution if it helps!

 

dyapasrikanth
Path Finder

This is working fine for one day's data, even my search range is last 7days it is just giving today's data only.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @dyapasrikanth 

Can you try this

index=abc "userId:" 
| where date_hour>=9 AND date_hour<=18
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count"

---

An upvote would be appreciated if it helps!

dyapasrikanth
Path Finder

It is still giving data from 00:00 to 23:00

dyapasrikanth_0-1624844139894.png

 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @dyapasrikanth 

I wish this can be done better, however date_hour i understood its not being extracted by Splunk from _time but actually its from original event FYI. About default fields (host, source, sourcetype, and more) - Splunk Documentation

Following should work, extracted hour from _time. you would find events upto 17:59 as time_hour = 17,  you need to further change this condition using time_min

 

index=abc "userId:" 
| eval time_hour=strftime(_time, "%H") , time_min=strftime(_time, "%M")
| where time_hour >=9 AND time_hour<=17 
| rex field=message "userId: (?<customerId>.*)" 
| timechart span=1h dc(customerId) as "Unique customer count"

 

---

An upvote would be appreciated if it helps!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>