Question)
If my store is open through 1pm~2am and I want to see how many chickens I sold on one day, Splunk would count the
chickens I sold from 12am~2am to the next day and count the chickens I sold the day before.
I want to make a line chart of this but the calculations are wrong because of this.
Can anybody help?
Hi hyngjoon,
The goal would be to identify whether an event occurred yesterday or today, then compare the datehours.
Nadine
...
| eval yesterday=relative_time(now(), "-1d@d")
| eval today=relative_time(now(), "@d")
| eval hr=strftime(_time, "%H")
| eval hr=tonumber(hr)
| where (_time >= yesterday AND hr > 12) OR (_time >= today AND hr <=2)
Hi hyngjoon,
The goal would be to identify whether an event occurred yesterday or today, then compare the datehours.
Nadine
...
| eval yesterday=relative_time(now(), "-1d@d")
| eval today=relative_time(now(), "@d")
| eval hr=strftime(_time, "%H")
| eval hr=tonumber(hr)
| where (_time >= yesterday AND hr > 12) OR (_time >= today AND hr <=2)