topic query for time in Getting Data In

query for time

DTERM — Tue, 17 May 2011 17:01:27 GMT

I need a query that will extract all log data between (say) 10:00 PM and 10:00 AM. What is the best way to accomplish this?

TIA

Re: query for time

jbsplunk — Tue, 17 May 2011 17:06:46 GMT

 index=* earliest=05/16/2011:22:0:0 latest=05/17/2011:10:0:0

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch

Specify absolute time ranges in your search

When searching or saving a search, you can specify time ranges using the following attributes:

earliest=<time_modifier> 
latest=<time_modifier>

For exact time ranges, the syntax of time_modifier is: %m/%d/%Y:%H:%M:%S. For example, to specify a time range from 12AM October 19, 2009 to 12AM October 27, 2009:

earliest=10/19/2009:0:0:0 latest=10/27/2009:0:0:0

If you specify only the "earliest" attribute, "latest" is set to the current time (now) by default. In general, you won't specify "latest" without an "earliest" time.

Important: When you specify a time range in your search or saved search, it overrides the time range that is selected in the dropdown menu. However, the time range specified directly in the search string will not apply to subsearches (but the dropdown selected range will apply).

Re: query for time

MarioM — Mon, 28 Sep 2020 09:34:23 GMT

can earliest only be time or does it have to include date? because the only way i find myself to search time range across differents dates is to use a search which says :

date_hour > 23 OR date_hour < 11 and then select a date range in the dropdown menu

Re: query for time

jbsplunk — Tue, 17 May 2011 17:34:40 GMT

It does not have to include a date. Relative time modifiers can be used as per the documentation here:

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relative_time_modifiers

so something like 'earliest=@d-2h' specifies 10PM, for example.

Re: query for time

MarioM — Tue, 17 May 2011 17:47:05 GMT

thanks! for the original question example it will be something like

'earliest=@d-2h latest=@d+10' ?

Re: query for time

jbsplunk — Tue, 17 May 2011 17:53:08 GMT

That ought to do it.