how to distribute events across non standard business day timerange

[marcoscala]

Hi!
Our customer (broadcaster...) needs to aggregare events "by day" where their "business day" spans from 6:00AM to 5:59AM of the following day.

We have to modify all our 5-10 days reports of events to reflect this custom aggregation.

Any hints or Suggestions?!

Thanks a lot!

Marco

[alacercogitatus]

You could subtract 6 hours from each event time, so when you do a by day, it thinks events at 7AM really happened at 1AM.

your_search | eval _time = _time - (3600 * 6) | do_other_timecharty things

This will move all events from 6AM - 5:59AM to 12AM - 11:59PM, thereby allowing your timecharts to split by day.

[martin_mueller]

Here's a thought:

index=_internal | eval business_day_time = relative_time(_time, "-6h") | bucket business_day_time span=1d | stats count by business_day_time | fieldformat business_day_time = strftime(business_day_time, "%+")