Hi splunk, I had a search of
sourcetype="ltaTraffic" Type="Accident" tag=expressway earliest=-30d | transaction locationaccident maxspan=1s | bucket span=1h _time | dedup locationaccident| fields onexpressway, locationaccident, current_area | eval date=strftime(_time, "%m/%d/%Y %H:%M:%S") | chart count(locationaccident) as Accidents by date | sort -Accidents | head 25 | sort date
How can I define the time from 6am to 6pm of 1 week ? I know starttime and endtime but it won't work as I am collecting data all the way.
To limit the results to certain hours of the day, construct your search to include the actual hour of the event, and restrict your search accordingly. Thankfully this is a standard default field. Add the following to your basic search clause:
date_hour>=6 date_hour<18
If you wanted a more specific time window things would get distinctly more complex.