Security

Can you help me find the access time range between hours on a single day?

vpurushottam
Explorer

Hello guys,

I am trying to search/formulate a method to determine the range of time (hours) in a day for which the resource was accessed. To clarify it, I have given an example below because, as of now, I don't have any query to paste here. I am still searching for a way to do that.

what I have:

2019-01-01 15:40:55 "Record X accessed"
2019-01-01 15:50:38 "Record Z accessed"
2019-01-01 16:08:40 "Record Y accessed"
2019-01-01 16:48:29 "Record xx accessed"
2019-01-02 13:43:29 "Record xx accessed"
2019-01-02 13:48:29 "Record xx accessed"
2019-01-02 16:08:43 "Record xx accessed"
2019-01-02 17:48:29 "Record xx accessed"
2019-01-03 6:48:29 "Record xx accessed"
2019-01-03 7:35:57 "Record xx accessed"
2019-01-03 8:45:29 "Record xx accessed"
2019-01-03 10:35:29 "Record xx accessed"

What I want:

2019-01-01 3PM - 5PM
2019-01-02 1PM - 6PM
2019-01-03  6AM - 11AM

I don't need the 3 field here as that has been taken care of, and if you need to know what the 3 field is, it is actually a 10 digit long records number.

Please help me with any idea, links, or resources that i can look into.

Thank you in advance.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

You can do something like this:

| eval date = strftime(_time, "%Y-%m-%d") 
| stats latest(_time) as end earliest(_time) as start by date 
| eval end = strftime(end, "%I:%M %p")
| eval start= strftime(start, "%I:%M %p") 
| table date start end

All the best

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

You can do something like this:

| eval date = strftime(_time, "%Y-%m-%d") 
| stats latest(_time) as end earliest(_time) as start by date 
| eval end = strftime(end, "%I:%M %p")
| eval start= strftime(start, "%I:%M %p") 
| table date start end

All the best

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...