https://community.splunk.com/t5/Getting-Data-In/How-can-I-achieve-the-query-for-retrieving-data-for-a-particular/m-p/628585#M107875 <P>How can I achieve the query for retrieving data for a particular time for the last 6 days? Suppose I want to get the data for last 6 days from time 12.00 A.M to 4.00 P.M. Please help on the same</P> Fri, 27 Jan 2023 19:46:03 GMT Subarna 2023-01-27T19:46:03Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-achieve-the-query-for-retrieving-data-for-a-particular/m-p/628585#M107875 <P>How can I achieve the query for retrieving data for a particular time for the last 6 days? Suppose I want to get the data for last 6 days from time 12.00 A.M to 4.00 P.M. Please help on the same</P> Fri, 27 Jan 2023 19:46:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-achieve-the-query-for-retrieving-data-for-a-particular/m-p/628585#M107875 Subarna 2023-01-27T19:46:03Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-achieve-the-query-for-retrieving-data-for-a-particular/m-p/628586#M107876 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/251656">@Subarna</a>,</P><P>you have to run a search for the full period adding a filter on the hosu, something like this:</P><LI-CODE lang="markup">index=your_index earliest=-6d@d latest=@d (date_hour&gt;11 date_hour&lt;17) | ...</LI-CODE><P>if you haven't date _hour, you have to extract it:</P><LI-CODE lang="markup">index=your_index earliest=-6d@d latest=@d | eval date_hour=strftime(_time,"%H") | where date_hour&gt;11 AND date_hour&lt;17 | ...</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 27 Jan 2023 09:12:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-achieve-the-query-for-retrieving-data-for-a-particular/m-p/628586#M107876 gcusello 2023-01-27T09:12:41Z