Splunk Search

current hour

LauraBre
Communicator

Hello,

I want to have the hour of the current time but I don't able to have it because now() returns all the current date but just want to have the current hour.

this is my search :

source="tcp:5543" |eval date_hour=strftime(_time, "%H") | rangemap field=count severe=0-0 elevated=1-50 default=low | eval range=if(date_hour>9 AND date_hour<14 AND count<11, "low",if(date_hour > 13 AND date_hour < 24 AND count > 11, "severe", range))

I want to run this search only on the current hour. I test it with "earliest" and "latest" but it retunrs 2 hours if it is 14:30 for example.

Thanks by advance to your help.

Laura

Tags (1)
0 Karma

lpolo
Motivator

Try this:

earliest=@h latest=now

Lp

LauraBre
Communicator

It's perfect thx very much.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...