topic Question about time searches in Getting Data In

Question about time searches

Antioch — Thu, 20 Jun 2013 18:12:52 GMT

Hello splunk community, I'm brand new at using the software and I seem to run into a point that I cant find any documentation to cover. Basically what I'm trying to do is create a search string that pulls logons before a certain time and after a certain time, and that also pulls all logins on Saturday and Sunday. In the search manual and in the search reference I found the search terms earliestand latest, but these correspond to when the search was run, not the actual time of the log. Can anyone give me a hand with this?

Re: Question about time searches

sdaniels — Thu, 20 Jun 2013 19:05:37 GMT

It sounds like you want to do something like this:

http://splunk-base.splunk.com/answers/54981/specify-a-time-window-to-search-during-non-business-hours

The time modifiers will apply to the timestamp for your actual events. Therefore, you can specify a search with earliest=-2d@d latest=-1d@d to only look at data based on your search for 2 days ago only or earliest=@w0 to search events since the beginning of the current week.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/SearchTimeModifiers

Re: Question about time searches

Antioch — Thu, 20 Jun 2013 19:13:16 GMT

That's exactly what I was looking for thanks!