topic Re: extract events for specific time period in Splunk Search

extract events for specific time period

remy06 — Tue, 08 May 2012 09:46:30 GMT

I've just configured splunk to index a file that contains events for the last 30 days. Within these events I want to search for all events that fall between 8pm and 8am only.

The format of events are such:

4/30/2012 6:48:32 PM,"xxxxx\xxxxxx","xxxxx",........."
4/30/2012 8:50:30 PM,"xxxxx\xxxxxx","xxxxx",........."
....

Splunk has automatically extracted this field "Date_time" > "4/30/2012 6:48:32 PM"

Any idea?

Re: extract events for specific time period

kristian_kolb — Tue, 08 May 2012 10:04:25 GMT

Unless they're WinEventLogs, there should also be a field called date_hour, which can be used;

sourcetype=your_sourcetype date_hour > 20 OR date_hour < 8 | ...

EDIT: corrected the hour value

Hope this helps,

Kristian

Re: extract events for specific time period

kristian_kolb — Tue, 08 May 2012 10:15:25 GMT

oops, see edit above. /k