Reporting

How do you set up a time range from 7 pm to 2 pm for a scheduled hourly report?

shaikhussain2
Explorer

We had set up a report which triggers on an hourly basis from 8PM to 2PM (earliest = -1d@d+20h & latest = @d+14h) but we are getting correct reports starting from 12:00 AM only and before that its taking last 24 hours report (9PM, 10PM, 11PM reports).

Thanks,
Shaik Hussain

0 Karma
1 Solution

datasearchninja
Communicator

You need to add some hours into the calculation to shift the base hours into the next day when it is somewhere between 8pm -> midnight

So:
earliest=+4h@d-4h
When it is between midnight and 8pm, this will calculate to 8pm yesterday, after 8pm it will be 8pm today

latest=+4h@d+14h
When it is between midnight and 8pm, this will calculate to 2pm today, after 8pm it will be 2pm tommorrow

View solution in original post

0 Karma

datasearchninja
Communicator

You need to add some hours into the calculation to shift the base hours into the next day when it is somewhere between 8pm -> midnight

So:
earliest=+4h@d-4h
When it is between midnight and 8pm, this will calculate to 8pm yesterday, after 8pm it will be 8pm today

latest=+4h@d+14h
When it is between midnight and 8pm, this will calculate to 2pm today, after 8pm it will be 2pm tommorrow

0 Karma

shaikhussain2
Explorer

Thanks colin, It is working perfectly now and thanks for elaborating the answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...