https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379279#M168053 <P>Would you please provide more information about what you are trying to do and how you are trying to do it?</P> Mon, 30 Jul 2018 10:48:11 GMT richgalloway 2018-07-30T10:48:11Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379278#M168052 <P>Dear all.</P> <P>Please support me about monitor and statistics log from 22.00 to 8.00 </P> <P>Thanks</P> Mon, 30 Jul 2018 08:46:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379278#M168052 hiepdv4 2018-07-30T08:46:36Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379279#M168053 <P>Would you please provide more information about what you are trying to do and how you are trying to do it?</P> Mon, 30 Jul 2018 10:48:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379279#M168053 richgalloway 2018-07-30T10:48:11Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379280#M168054 <P>It can be extracted under the following conditions. I think it should be macrosized for a long time.</P> <PRE><CODE>(your search) (date_hour=22 OR date_hour=23 OR date_hour=0 OR date_hour=1 OR date_hour=2 OR date_hour=3 OR date_hour=4 OR date_hour=5 OR date_hour=6 OR date_hour=7 OR date_hour=8) </CODE></PRE> Mon, 30 Jul 2018 11:50:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379280#M168054 HiroshiSatoh 2018-07-30T11:50:01Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379281#M168055 <P>Dear Hiroshi-san</P> <P>Thanks for support.</P> <P>Regards</P> Tue, 31 Jul 2018 02:18:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-log-time-from-22-00-to-8-00/m-p/379281#M168055 hiepdv4 2018-07-31T02:18:19Z