topic Re: How Can I customize Time in Splunk Search

How Can I customize Time

clyde772 — Thu, 20 Jan 2011 10:49:21 GMT

Hello Gurus!

Here is what I am trying to do. I am trying using Simplified XML, Form to select a certain host and time, that will only analyze selected day's 8:00 - 16:00 time frame data only.

I know you can do this, where I can define into search

date_hour>8 date_hour<18

But when I added this into my form search xml view, the app wouldnt take it.

to summarize

How can I make it so that when the user select a date then it analyze for only that day's 8:00 ~ 16:00 ?
what would be the syntax for defining "every day, 8:00 ~ 16:00" in splunk?

Thanks~!

Re: How Can I customize Time

sideview — Thu, 20 Jan 2011 11:45:15 GMT

Maybe you're not escaping the < and > characters?

<searchTemplate>... your search here ... date_hour>8 date_hour<18</searchTemplate>

If that's not it, I would post the XML in the question. I'll bet we can figure it out.

Re: How Can I customize Time

clyde772 — Thu, 20 Jan 2011 23:30:20 GMT

Nick, Thanks!
It worked. How stupid of me. I appreciate it.

Re: How Can I customize Time

sideview — Fri, 21 Jan 2011 00:50:16 GMT

No problem. Believe me it's a common thing lots of people run into. I Go ahead and can accept my answer and/or vote it up so it'll drop off the 'unanswered questions' page.