topic How to define a time range for specific time range logs to be collected every month? in Dashboards & Visualizations

How to define a time range for specific time range logs to be collected every month?

lllidan — Mon, 09 Jul 2018 09:28:11 GMT

i want to collect logs that from 10 p.m to next day 4 a.m everyday in per month , how can i define the time range ? it seems "date_hour" field doesn't work.

Re: How to define a time range for specific time range logs to be collected every month?

manish_singh_77 — Mon, 09 Jul 2018 11:35:46 GMT

Pls refer the below mentioned links and let me know in case of any queires.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Specifytimemodifiersinyoursearch
https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchTutorial/Aboutthetimerangepicker

Re: How to define a time range for specific time range logs to be collected every month?

manish_singh_77 — Mon, 09 Jul 2018 13:40:39 GMT

earliest=@d-2h latest=@d+4h

Re: How to define a time range for specific time range logs to be collected every month?

manish_singh_77 — Mon, 09 Jul 2018 13:40:57 GMT

Try this as well and let me know in case of any queries..

Re: How to define a time range for specific time range logs to be collected every month?

woodcock — Mon, 09 Jul 2018 16:34:44 GMT

Like this:

Your Base Search Here
| eval date_hourmin = strftime(_time, "%H%M")
| where (date_hourmin >= 2200 AND date_hourmin <= 400)

Re: How to define a time range for specific time range logs to be collected every month?

lllidan — Tue, 10 Jul 2018 02:00:26 GMT

this search can only display one day's logs, if I select the time range option with "month to date", it just display today's logs, not everyday's specific time range.

Re: How to define a time range for specific time range logs to be collected every month?

woodcock — Tue, 10 Jul 2018 02:12:12 GMT

remove the earliest= and latest= parts of the search string.

Re: How to define a time range for specific time range logs to be collected every month?

lllidan — Tue, 10 Jul 2018 09:41:31 GMT

"@d-2h @d+4h" like this ?

Re: How to define a time range for specific time range logs to be collected every month?

lllidan — Tue, 29 Sep 2020 20:23:46 GMT

your answer solved my problem , except one mistake , "| where date_hourmin>=2200 OR date_hourmin<=400"