Splunk Search

How to fetch last 24 hours data with query?

tkadale
Path Finder

Hi,

I want to fetch last 24 hours data.

Generally we can select time range with Time picker and graph will show the data according to selected Time. But this time i want to show table column with max power usage in last 24 hours for each host.

Thanks in advance

Tags (1)
0 Karma

geetanjali
Path Finder

Thanks For quick response,

But my requirement is bit different.

I have one field "PowerUsage".

I want to display a table. first column in Host name, second is max of powerUsage by host. these two fields are OK. But i want third column as maximum powerUsage in last 24 hours.And "maximum power usage in last 24 hours" is not a field in log file. I need to extract the same for all hosts.

How to display these three columns in a single table.

Thanks in advance..

0 Karma

geetanjali
Path Finder

Thanks For quick response,
But my requirement is bit different.
I have one field "PowerUsage".
I want to display a table. first column in Host name, second is max of powerUsage by host. these two fields are OK. But i want third column as maximum powerUsage in last 24 hours.And "maximum power usage in last 24 hours" is not a field in log file. I need to extract the same for all hosts.
How to display these three columns in a single table.
Thanks in advance..

0 Karma

sideview
SplunkTrust
SplunkTrust

Well if there's a field called powerUsage in the raw events, and you want to draw a timechart split by host, it's just:

<search terms> | timechart max(powerUsage) by host

You can throw a 'span=1h' right after the timechart, but if you run that search over 24 hours I'm pretty sure timechart will automatically pick 1 hour buckets for you.

On the other hand, if you literally want to just show the max power usage for each host:

<search terms> | stats max(powerUsage) by host

However I wonder if there's some detail missing from your question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...