Splunk Search

Timechart - span=30m show data in 15th and 45th min

askkawalkar
Path Finder

I am trying to create a timechart
base search ...
| timechart span=30m latest(COUNT) as COUNT by NAME

it is providing me events for field "_time" as : "12:00", "12:30", "01:00", "01:30" .. and so on..

I want field "_time" as : "12:15", "12:45", "01:15", "1:45" ... and so on...

Is there any solution to convert _time.

Thanks in advance.

1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @askkawalkar,

This query worked for me. Instead of timechart use below list of evals, stat and chart to achieve your requirement.

<your query>
| bin _time span=15m 
| stats latest(COUNT) as COUNT by _time, NAME
| eval _time=_time/100 
| eval _time=if(_time%2==0,_time-9,_time) 
| eval _time=_time*100 
| chart last(COUNT) as COUNT over _time by NAME

View solution in original post

0 Karma

adonio
Ultra Champion

here is another way of achieving your goal with the aligntime attribute:
read here:
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Bin#Bin_options

run this search anywhere:

| gentimes start=-2 increment=1m
| eval _time = starttime 
| eval number = random()%200
| bin _time span=30m aligntime=@d+15m
| timechart max(number) as max_number

hope it helps

0 Karma

askkawalkar
Path Finder

Hi @adonio ,

Thanks for your help in search anywhere.

Thanks,
Ankush

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@askkawalkar - Did you get chance to check answer?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @askkawalkar,

This query worked for me. Instead of timechart use below list of evals, stat and chart to achieve your requirement.

<your query>
| bin _time span=15m 
| stats latest(COUNT) as COUNT by _time, NAME
| eval _time=_time/100 
| eval _time=if(_time%2==0,_time-9,_time) 
| eval _time=_time*100 
| chart last(COUNT) as COUNT over _time by NAME
0 Karma

askkawalkar
Path Finder

Hi @VatsalJagani ,

Thanks for your quick help. This solution worked for me.

Below is the run anywhere query (@adonio: thanks for providing run anywhere search)

| gentimes start=-2 increment=30m
 | eval _time = starttime 
 | eval number = random()%200
| bin _time span=15m 
 | stats latest(number) as COUNT by _time
 | eval _time=_time/100 
 | eval _time=if(_time%2==0,_time-9,_time) 
 | eval _time=_time*100 
 | chart last(COUNT) as COUNT over _time

Regards,
Ankush

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...