topic Re: How to create a 14 day search for specific time range (02:00 - 06:00) only? in Splunk Search

How to create a 14 day search for specific time range (02:00 - 06:00) only?

ashidhingra — Mon, 18 Jul 2022 21:27:45 GMT

How to create a 14 day search for specific time range (02:00 - 06:00) only?

Re: How to create a 14 day search for specific time range (02:00 - 06:00) only?

burwell — Mon, 18 Jul 2022 21:30:19 GMT

I think you would have to carefully craft a string of earliestTime >= and latestTime <= for all the four hour time slots over the past 14 days.

Re: How to create a 14 day search for specific time range (02:00 - 06:00) only?

bowesmana — Mon, 18 Jul 2022 23:20:58 GMT

You can either set up the search with multiple ranges in the search string, i.e.

index=... criteria=... ((earliest=@d+2h latest=@d+6h) OR (earliest=-d@d+2h latest=-d@d+6h) OR (earliest=-2d@d+2h latest=-2d@d+6h) OR (earliest=-3d@d+2h latest=-3d@d+6h) OR (earliest=-4d@d+2h latest=-4d@d+6h) OR (earliest=-5d@d+2h latest=-5d@d+6h) OR (earliest=-6d@d+2h latest=-6d@d+6h) OR (earliest=-7d@d+2h latest=-7d@d+6h) OR (earliest=-8d@d+2h latest=-8d@d+6h) OR (earliest=-9d@d+2h latest=-9d@d+6h) OR (earliest=-10d@d+2h latest=-10d@d+6h) OR (earliest=-11d@d+2h latest=-11d@d+6h) OR (earliest=-12d@d+2h latest=-12d@d+6h) OR (earliest=-13d@d+2h latest=-13d@d+6h) OR (earliest=-14d@d+2h latest=-14d@d+6h)) ...

or you can search for 2 weeks of data and then filter the appropriate time ranges out you want.

Re: How to create a 14 day search for specific time range (02:00 - 06:00) only?

gcusello — Tue, 19 Jul 2022 07:02:56 GMT

Hi @ashidhingra,

if you have the time_hour field, you could use a search like this:

index=your_index earliest=-14d@d latest=@d (time_hour>1 time_hour<7) | ...

if you haven't this field, you have to extract it

index=your_index earliest=-14d@d latest=@d | eval time_hour=strftime(_time,"H") | where (time_hour>1 AND time_hour<7) | ...

Ciao.

Giuseppe

Re: How to create a 14 day search for specific time range (02:00 - 06:00) only?

ashidhingra — Tue, 19 Jul 2022 13:27:28 GMT

Is there a way to only show the time of the query on the timechart

Re: How to create a 14 day search for specific time range (02:00 - 06:00) only?

bowesmana — Tue, 19 Jul 2022 21:58:22 GMT

I don't believe you can remove the 6am-2am regions from the chart, but you might want to look at the timewrap command

https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Timewrap

which would allow you to plot all points one the same chart 2am-6am of the current day and to show the other days in the same time slot, but as different data series.