Splunk Search

timechart span starting at specified point

vaijpc
Communicator

I want to run a timechart 'overnight'... e.g. getting the minimum values of a field between midday and midday... 12-12

If I wanted minimum values between midnight and midnight, 0-24, it would be easy, just timechart foo span=1day. I don't know how to offset it by the 12 hours required though.

I guess I 'could' use span=12h and then manually look at the minimums of the 12-24,0-12 but that means then grouping those and taking the minimum... possibly manually...?

<>

Tags (1)
0 Karma

woodcock
Esteemed Legend

Run it at midnight for the last 36 hours and do this:

...  earliest = -36h@h latest -12h@h | timechart span=1h min(foo)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...