Dashboards & Visualizations

Looking for events in "All time" during specific hours

mreznik
Engager

Hi,

I need to find a way to look for events in "All Time", but only during specific hours, e.g. between 9am and 5pm.

Any suggestions?

Thanks!

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

As stated below, date_hour is the field to operate on. It is extracted/created for almost all types of log - but not for windows event logs. Bleh.

/k

0 Karma

cvajs
Contributor

example
index=cisco_esa (date_hour<=16 AND date_hour>=9)
9am to 4:59:59:999pm

it will bucket the events using 1hr slots, so you get 8 slices per day, but you can modify that is needed, etc.

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...