How to define a time range for specific time range logs to be collected every month?

[lllidan]

i want to collect logs that from 10 p.m to next day 4 a.m everyday in per month , how can i define the time range ? it seems "date_hour" field doesn't work.

[woodcock · Accepted solution]

Like this:

Your Base Search Here
| eval date_hourmin = strftime(_time, "%H%M")
| where (date_hourmin >= 2200 AND date_hourmin <= 400)

[lllidan]

your answer solved my problem , except one mistake , "| where date_hourmin>=2200 OR date_hourmin<=400"

[manish_singh_77]

Pls refer the below mentioned links and let me know in case of any queires.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Specifytimemodifiersinyoursearch
https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchTutorial/Aboutthetimerangepicker

[manish_singh_77]

earliest=@d-2h latest=@d+4h

[lllidan]

this search can only display one day's logs, if I select the time range option with "month to date", it just display today's logs, not everyday's specific time range.

[woodcock]

remove the earliest= and latest= parts of the search string.

[lllidan]

"@d-2h @d+4h" like this ?

[manish_singh_77]

Try this as well and let me know in case of any queries..