topic Re: Search field value in interval in Splunk Search

Search field value in interval

light_of_sirius — Mon, 14 Sep 2020 09:29:22 GMT

Hello,

i am trying to search for field values in intervall (79,90).

Both versions do not work properly as i know what to expect.

index=XXX earliest="08/03/2020:15:00:00" latest="08/03/2020:16:30:00" TEMP<90 TEMP>79 | stats count as Counter

index=XXX earliest="08/03/2020:15:00:00" latest="08/03/2020:16:30:00" TEMP<90 AND TEMP>79 | stats count as Counter

Re: Search field value in interval

ITWhisperer — Mon, 14 Sep 2020 09:42:59 GMT

Your date time format seems a little different, usually there is a space between the date and the time not a colon. Do you have some sample data events you could share?

Re: Search field value in interval

thambisetty — Mon, 14 Sep 2020 09:45:26 GMT

is TEMP field ?

I have tried below and working fine.

index=_internal earliest="09/14/2020:11:00:00" latest="09/14/2020:13:00:00" date_hour>11 date_hour<13

Re: Search field value in interval

thambisetty — Mon, 14 Sep 2020 09:46:54 GMT

@ITWhisperer

earliest and latest time format will have column in between date & time.

Re: Search field value in interval

ITWhisperer — Mon, 14 Sep 2020 09:49:09 GMT

Yes I just checked _internal - still would be useful to have some sample data though

Re: Search field value in interval

light_of_sirius — Mon, 14 Sep 2020 10:44:57 GMT

Yeah it works fine. Turns out what i expected to expect was not what i should have expected 🙂 Sry