topic How to search by specific date and time range and compare with other date and time stats? in Splunk Search

How to search by specific date and time range and compare with other date and time stats?

mikeyty07 — Thu, 22 Dec 2022 15:16:10 GMT

I am trying to search with specific date and time. Is it possible to search and compare?

for example, i want to get stats from 2022-12-20 14:00:00 to 2022-12-20 15:00:00 and compare it with other dates like 12/16, 12/10/, 12/5 with same time range. is there a way to get stats compared side by side with other dates
OR
just have the all mentioned dates and time (2p-3p) there in search query ?

Re: search by specific date and time range and compare with other date and time stats

bowesmana — Wed, 21 Dec 2022 23:17:42 GMT

Just put the date/time ranges in the query

(earliest="12/20/2022:14:00:00" latest="12/20/2022:15:00:00") OR (earliest="12/16/2022:14:00:00" latest="12/16/2022:15:00:00") OR (earliest="12/10/2022:14:00:00" latest="12/10/2022:15:00:00")

and the the simplest way is to then

| bin _time span=1d | stats count by _time

or you may have date_hour field auto extracted, in which case you could just set the time picker and use date_hour=3