https://community.splunk.com/t5/Splunk-Search/current-hour/m-p/72875#M181001 <P>It's perfect thx very much.</P> Tue, 12 Jun 2012 13:19:07 GMT LauraBre 2012-06-12T13:19:07Z https://community.splunk.com/t5/Splunk-Search/current-hour/m-p/72873#M180999 <P>Hello,</P> <P>I want to have the hour of the current time but I don't able to have it because now() returns all the current date but just want to have the current hour. </P> <P>this is my search : </P> <PRE><CODE>source="tcp:5543" |eval date_hour=strftime(_time, "%H") | rangemap field=count severe=0-0 elevated=1-50 default=low | eval range=if(date_hour&gt;9 AND date_hour&lt;14 AND count&lt;11, "low",if(date_hour &gt; 13 AND date_hour &lt; 24 AND count &gt; 11, "severe", range)) </CODE></PRE> <P>I want to run this search only on the current hour. I test it with "earliest" and "latest" but it retunrs 2 hours if it is 14:30 for example.</P> <P>Thanks by advance to your help.</P> <P>Laura</P> Tue, 12 Jun 2012 12:41:52 GMT https://community.splunk.com/t5/Splunk-Search/current-hour/m-p/72873#M180999 LauraBre 2012-06-12T12:41:52Z https://community.splunk.com/t5/Splunk-Search/current-hour/m-p/72874#M181000 <P>Try this:</P> <P>earliest=@h latest=now</P> <P>Lp</P> Tue, 12 Jun 2012 12:51:57 GMT https://community.splunk.com/t5/Splunk-Search/current-hour/m-p/72874#M181000 lpolo 2012-06-12T12:51:57Z https://community.splunk.com/t5/Splunk-Search/current-hour/m-p/72875#M181001 <P>It's perfect thx very much.</P> Tue, 12 Jun 2012 13:19:07 GMT https://community.splunk.com/t5/Splunk-Search/current-hour/m-p/72875#M181001 LauraBre 2012-06-12T13:19:07Z