topic Re: I want to ready value on specific time for last one week in Splunk Search

I want to ready value on specific time for last one week

manapuna — Fri, 19 Jan 2018 02:19:31 GMT

I want to read specific string between 9:15-9:45, each day for last 7 days.

host=manana string | stats dc(count)

Thanks,

horsefez — Fri, 19 Jan 2018 13:35:39 GMT

Could you please give us more detail.
I do not know what you are trying to do here.

Do you want do search for events that happen in a specified time-window every day for the last 7 days?

FrankVl — Tue, 29 Sep 2020 17:45:25 GMT

Assuming your question is about filtering for "between 9:15-9:45", I think you should be able to do that using the date_hour and date_minute fields.

date_hour=9 AND date_minute>=15 AND date_minute<=44

mayurr98 — Fri, 19 Jan 2018 14:06:02 GMT

hey you can try something like this

index=<your_index> date_hour=9 date_minute>=15 date_minute<=44 host=manana string | timechart span=1d count

Run this last seven days and you will get dayswise count from 9:15 to 9:45.
let me know if this helps!

mayurr98 — Tue, 29 Sep 2020 17:41:38 GMT

date_minute<=45 will contain data from 9:45:00 to 9:45:59 as well
So it should be date_minute<=44

FrankVl — Fri, 19 Jan 2018 15:12:02 GMT

Good catch, let me adjust that in my answer.