Splunk Search

How to add the multiple timelines into one timeline.

RENUKA1
Loves-to-Learn Lots

Hello All,
 I need to convert the Timeline with different times into one.
For example:
12:05AM 12:10AM 12:15AM should be  taken as 12AM
1:05AM 1:10AM 1:15AM should be  taken as 1AM and vice versa.

Can you please help me to write a query for this.

Timeline

Top 10 Values

Count% 
01:10:02 AM20.368%
 
01:20:02 PM20.368%
 
01:30:02 AM20.368%
 
01:35:02 PM20.368%
 
01:45:02 PM20.368%
 
01:50:02 AM20.368%
 
02:05:02 PM20.368%
 
02:10:02 PM20.368%
 
02:40:02 PM20.368%
 
03:05:02 PM





Thank you. 

Labels (1)
Tags (1)
0 Karma

RENUKA1
Loves-to-Learn Lots

@bowesmana  Thanks for help 
but I need the output in AM and PM sequence.Here is my actual output 

01:00:02 AM9.14
01:00:02 PM12.06
01:05:02 AM10.00
01:05:02 PM11.17
01:10:02 AM

 

I except the output to be in first all the AM time should be display and followed by PM

01:00:02 AM9.14
01:00:02 AM12.06
01:05:02 AM10.00
01:05:02 PM11.17
01:10:02 PM
0 Karma

yuanliu
SplunkTrust
SplunkTrust

This is confusing.  The order of output is determined by the order in which your data comes back from index search, not altered by bin command that @bowesmana suggests.  If your data input is not ordered, simply sort your data.

| bin _time span=1h
| sort _time
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use the bin command, e.g.

| bin _time span=1h
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...