Hi!
Our customer (broadcaster...) needs to aggregare events "by day" where their "business day" spans from 6:00AM to 5:59AM of the following day.
We have to modify all our 5-10 days reports of events to reflect this custom aggregation.
Any hints or Suggestions?!
Thanks a lot!
Marco
You could subtract 6 hours from each event time, so when you do a by day, it thinks events at 7AM really happened at 1AM.
your_search | eval _time = _time - (3600 * 6) | do_other_timecharty things
This will move all events from 6AM - 5:59AM to 12AM - 11:59PM, thereby allowing your timecharts to split by day.
Here's a thought:
index=_internal | eval business_day_time = relative_time(_time, "-6h") | bucket business_day_time span=1d | stats count by business_day_time | fieldformat business_day_time = strftime(business_day_time, "%+")