I am trying to create a timechart
base search ...
| timechart span=30m latest(COUNT) as COUNT by NAME
it is providing me events for field "_time" as : "12:00", "12:30", "01:00", "01:30" .. and so on..
I want field "_time" as : "12:15", "12:45", "01:15", "1:45" ... and so on...
Is there any solution to convert _time.
Thanks in advance.
Hello @askkawalkar,
This query worked for me. Instead of timechart use below list of evals, stat and chart to achieve your requirement.
<your query>
| bin _time span=15m
| stats latest(COUNT) as COUNT by _time, NAME
| eval _time=_time/100
| eval _time=if(_time%2==0,_time-9,_time)
| eval _time=_time*100
| chart last(COUNT) as COUNT over _time by NAME
here is another way of achieving your goal with the aligntime
attribute:
read here:
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Bin#Bin_options
run this search anywhere:
| gentimes start=-2 increment=1m
| eval _time = starttime
| eval number = random()%200
| bin _time span=30m aligntime=@d+15m
| timechart max(number) as max_number
hope it helps
Hi @adonio ,
Thanks for your help in search anywhere.
Thanks,
Ankush
@askkawalkar - Did you get chance to check answer?
Hello @askkawalkar,
This query worked for me. Instead of timechart use below list of evals, stat and chart to achieve your requirement.
<your query>
| bin _time span=15m
| stats latest(COUNT) as COUNT by _time, NAME
| eval _time=_time/100
| eval _time=if(_time%2==0,_time-9,_time)
| eval _time=_time*100
| chart last(COUNT) as COUNT over _time by NAME
Hi @VatsalJagani ,
Thanks for your quick help. This solution worked for me.
Below is the run anywhere query (@adonio: thanks for providing run anywhere search)
| gentimes start=-2 increment=30m
| eval _time = starttime
| eval number = random()%200
| bin _time span=15m
| stats latest(number) as COUNT by _time
| eval _time=_time/100
| eval _time=if(_time%2==0,_time-9,_time)
| eval _time=_time*100
| chart last(COUNT) as COUNT over _time
Regards,
Ankush