Splunk Search

How do I get a search with "timechart span=1d" to return and display events from the top of the hour?

Vignesh5r
New Member

I have a search like below.

If i run this search, let's say now, it fetches transaction (as per the display ) not from the TOP of the hour, but from the time I have run the search.

Let's say I run this for the last 7 days.
It takes only from 8/8 15:00 hrs till now and not 8/8 00:00 hrs until now.

I tried 1d and as well as 24 hours, but same thing. How do we have the result fetched from the top of the hour?

index!=_internal "test" |  rex "(?i)fieldname1=(?P[^]]+)" | dedup FIELDNAME | timechart span=1d count
0 Karma
1 Solution

sundareshr
Legend

Try this

index!=_internal "test" earliest="-7@d" |  rex "(?i)fieldname1=(?P[^]]+)" | dedup FIELDNAME | timechart span=1d count

View solution in original post

sundareshr
Legend

Try this

index!=_internal "test" earliest="-7@d" |  rex "(?i)fieldname1=(?P[^]]+)" | dedup FIELDNAME | timechart span=1d count

Masa
Splunk Employee
Splunk Employee

Vignesh5r
New Member

Thanks Masa!!

0 Karma

Vignesh5r
New Member

Thanks Sundar. This works. With the correction provided, i am indicatig the final query which worked and took transactions from 00:00 hrs 7 days ago till now.

index!=_internal "test" earliest="-7@d@d" |  rex "(?i)fieldname1=(?P[^]]+)" | dedup FIELDNAME | timechart span=1d count

Thanks once again Sundar

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...