https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338580#M100398 <P>Use the default field date_second.<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/Usedefaultfields#date_second" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/Usedefaultfields#date_second</A></P> Tue, 29 Sep 2020 15:10:01 GMT mwirth_splunk 2020-09-29T15:10:01Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338579#M100397 <P>How do I find whether the time stamp of an event covers a specific second within a day? So, we need to identify all the events for, let’s say, the second at the interval of 11:12:50 - 11:12:51.</P> <P>Something like <CODE>| eval mytime=strftime(_time, "%d")</CODE> but for the second...</P> Mon, 31 Jul 2017 14:58:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338579#M100397 ddrillic 2017-07-31T14:58:16Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338580#M100398 <P>Use the default field date_second.<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/Usedefaultfields#date_second" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/Usedefaultfields#date_second</A></P> Tue, 29 Sep 2020 15:10:01 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338580#M100398 mwirth_splunk 2020-09-29T15:10:01Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338581#M100399 <P>hello there,<BR /> hope i understood your question,<BR /> maybe use earliest and latest?<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Search/Specifytimemodifiersinyoursearch">http://docs.splunk.com/Documentation/Splunk/6.6.2/Search/Specifytimemodifiersinyoursearch</A><BR /> for example:<BR /> index = * sourcetype = * earliest = 7/31/2017:11:19:51 latest = 7/31/2017:11:19:52<BR /> you can also use the gui time picker for that</P> Mon, 31 Jul 2017 15:21:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338581#M100399 adonio 2017-07-31T15:21:48Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338582#M100400 <P>I see - the thing is that we have a long list of seconds we want to look at....</P> Mon, 31 Jul 2017 15:24:07 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338582#M100400 ddrillic 2017-07-31T15:24:07Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338583#M100401 <P>Perfect @adonio !!!</P> <P>The following seems to work -</P> <PRE><CODE>(earliest = 7/20/2017:20:00:00 latest = 7/20/2017:20:00:01) OR (earliest = 7/20/2017:21:00:00 latest = 7/20/2017:21:00:01) .... </CODE></PRE> Mon, 31 Jul 2017 15:50:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338583#M100401 ddrillic 2017-07-31T15:50:41Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338584#M100402 <P>Thank you for all you help!</P> Mon, 31 Jul 2017 15:57:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-second-from-time/m-p/338584#M100402 ddrillic 2017-07-31T15:57:30Z