i want to collect logs that from 10 p.m to next day 4 a.m everyday in per month , how can i define the time range ? it seems "date_hour" field doesn't work.
Your Base Search Here
| eval date_hourmin = strftime(_time, "%H%M")
| where (date_hourmin >= 2200 AND date_hourmin <= 400)
View solution in original post
your answer solved my problem , except one mistake , "| where date_hourmin>=2200 OR date_hourmin<=400"
Pls refer the below mentioned links and let me know in case of any queires.
this search can only display one day's logs, if I select the time range option with "month to date", it just display today's logs, not everyday's specific time range.
remove the earliest= and latest= parts of the search string.
"@d-2h @d+4h" like this ?
Try this as well and let me know in case of any queries..