Search within sub-time range

ghnwmlguy — Tue, 01 Feb 2011 09:04:19 GMT

I am trying to collect stats from login events from evening hours. I would like to run reports for any time range (last 60m, 7d, etc.) but only view results that show logons between the hours of 5pm and 7am.

Re: Search within sub-time range

David — Tue, 01 Feb 2011 09:15:20 GMT

You can add the following search criteria:

((date_hour > 17) OR (date_hour < 7))

And that should get you where you want to be. Personally, I use:

((date_wday="saturday" OR date_wday="sunday") OR (date_hour < 7 OR date_hour > 17))

You can then toss that in macros.conf like so:

[OffHours]
definition = ((date_wday="saturday" OR date_wday="sunday") OR (date_hour < 7 OR date_hour > 17))
iseval = 0

so you can just add in

`OffHours`

to your searches and have it automatically included.

topic Re: Search within sub-time range in Splunk Search

Search within sub-time range

Re: Search within sub-time range