Dashboards & Visualizations

How to define a time range for specific time range logs to be collected every month?

lllidan
New Member

i want to collect logs that from 10 p.m to next day 4 a.m everyday in per month , how can i define the time range ? it seems "date_hour" field doesn't work.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| eval date_hourmin = strftime(_time, "%H%M")
| where (date_hourmin >= 2200 AND date_hourmin <= 400)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| eval date_hourmin = strftime(_time, "%H%M")
| where (date_hourmin >= 2200 AND date_hourmin <= 400)
0 Karma

lllidan
New Member

your answer solved my problem , except one mistake , "| where date_hourmin>=2200 OR date_hourmin<=400"

0 Karma

manish_singh_77
Builder
0 Karma

manish_singh_77
Builder

earliest=@d-2h latest=@d+4h

0 Karma

lllidan
New Member

this search can only display one day's logs, if I select the time range option with "month to date", it just display today's logs, not everyday's specific time range.

0 Karma

woodcock
Esteemed Legend

remove the earliest= and latest= parts of the search string.

0 Karma

lllidan
New Member

"@d-2h @d+4h" like this ?

0 Karma

manish_singh_77
Builder

Try this as well and let me know in case of any queries..

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...