Splunk Search

Tabular report showing count based on time range

chintan_shah
Path Finder

Hi,

I need to create report in alt text format.
Could anyone help me in achieving this.
I can have time interval of 2 hours as well if cannot have in the format.

0 Karma

woodcock
Esteemed Legend

If you just need count, this should be lightning fast:

| tstats count where index=_* BY date_wday date_hour 
| eval date_wday=case(date_wday="sunday"   , "      sunday",
                      date_wday="monday"   , "     monday",
                      date_wday="tuesday"  , "    tuesday",
                      date_wday="wednesday", "   wednesday",
                      date_wday="thursday" , "  thursday",
                      date_wday="friday"   , " friday",
                      true(), date_wday)
| chart first(count) OVER date_hour BY date_wday
| addtotals row=t col=t
| eval date_hour=if(date_hour>23, "TOTAL", date_hour)
0 Karma

niketnilay
Legend

@chintan_shah, please check out Punchcard Custom Visualization App (https://splunkbase.splunk.com/app/3129/), it will load some examples with date_hour and count, which would plot the data as per your need.

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jackson1990
Path Finder

can you provide some input data? i mean with fields

0 Karma

chintan_shah
Path Finder

its just the count of events, my requirement is to show counts based on the time range.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!