Splunk Search

How do you use the timechart command to see a trendline of what time our game app starts each day?

zacksoft
Contributor

I have 5 different servers/hosts, and whenever the 'game app' initiates in it, an event with the string "Game Starting...." is created in each host. We usually start the app sequentially, one host after another, and we do this once every day.

I want to see a trendline of what time game was started each day (host wise), excluding weekends.

host="SERVER_Number_*"   "Game Starting..."
| timechart span=1d count _time   
Tags (1)
0 Karma

jlelli
Path Finder
host="SERVER_Number_*" "Game Starting..." | timechart span=1d count by host

Timechart already groups by _time so there is no need to add it

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...