topic Re: Select Time Range in Dashboards & Visualizations

Select Time Range

laudai — Mon, 24 Apr 2017 08:30:19 GMT

He guys
I have 2 years data

how do I get the Specify time ranges
e.g. from 6am to 12pm every days

Thanks for your answer.

dineshraj9 — Mon, 24 Apr 2017 08:34:57 GMT

Just restrict the inbuilt date_hour field to values 6 - 12

index=<your_index> | where date_hour>=6 and date_hour<=12

gcusello — Wed, 30 Sep 2020 02:54:20 GMT

Hi laudai,
in you search insert the following condition:
your_search date_hour>5 | ...

Bye.
Giuseppe

niketn — Mon, 24 Apr 2017 09:01:36 GMT

I would actually pipe to base search rather than additional where clause for two reasons:

1) Filtering records upfront in base search is faster.
2) search fieldName=value is faster than where fieldname=value

index=<your_index> date_hour>=6 and date_hour<=12

laudai — Mon, 24 Apr 2017 09:39:17 GMT

Is there has column name date_hour ? I can't use this search so I use Regular Expression

dineshraj9 — Mon, 24 Apr 2017 09:45:49 GMT

date_* default fields are not available for all sources, for instance they are not present for Windows event logs.

You can try creating the field like below and then filter -

| eval date_hour=strftime(_time,"%H") | where date_hour>=6 and date_hour<=12

laudai — Mon, 24 Apr 2017 10:15:53 GMT

Thanks for your answer.