Hi all,
I would like to use date_hour as part of the query. The result of date_hour showing 1,2,3....23. How can I change the format of date_hour to become e.g. 1 is 1:00 to 1:59, 20 is 20:00 to 20:59?
Thanks for your help in advance.
@krusovice, you can try the following
<yourcurrentsearch>
| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00",date_hour.":00")
| sort date_hour
Following is a run anywhere search based on Splunk's _internal index
index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by date_hour
| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00",date_hour.":00")
| sort date_hour
@krusovice, you can try the following
<yourcurrentsearch>
| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00",date_hour.":00")
| sort date_hour
Following is a run anywhere search based on Splunk's _internal index
index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by date_hour
| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00",date_hour.":00")
| sort date_hour
Hi @niketnilay,
It's work fine to display 01:00, 02:00...etc. However my requirement is to able to display as "01:00 - 01:59", how can I achieve that?
Try the following then:
| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00 - ".date_hour.":59",date_hour.":00 - ".date_hour.":59")
Thank you so much for the answer, my result looking great now 🙂
Glad it worked 🙂