topic Re: How do you insert a time range inside a query? in Dashboards & Visualizations

How do you insert a time range inside a query?

zacksoft — Mon, 21 Jan 2019 15:25:25 GMT

I am trying to define my search range inside a query by using the earliest / latest parameter or something similar. But, I am getting a syntax error. I tried a few different techniques.

The condition is...
"I want to count the number of events generated between 10 AM to 2 PM everyday for last 50 days"

Re: How do you insert a time range inside a query?

kamlesh_vaghela — Mon, 21 Jan 2019 15:30:01 GMT

@zacksoft

Can you please try this?

YOUR_SEARCH
 | eval date_hour=strftime(_time, "%H") 
 | search date_hour>=10 date_hour<=14 | stats count

Adding minute filter

YOUR_SEARCH
    | eval date_hour=strftime(_time, "%H"), date_min=strftime(_time, "%M") 
    | search date_hour>10 date_hour<14 OR (date_hour=10 date_min>=30) OR (date_hour=14 date_min<=45)  | stats count

Thanks

Re: How do you insert a time range inside a query?

zacksoft — Mon, 21 Jan 2019 15:37:04 GMT

Thanks,
What if I want to make it between 10:45 AM to 02:30 PM ?
How do I add the minute field ?

Re: How do you insert a time range inside a query?

kamlesh_vaghela — Tue, 22 Jan 2019 07:29:59 GMT

@zacksoft

I have updated my Answer. Can you please check it?