Dashboards & Visualizations

Select Time Range

laudai
Path Finder

He guys
I have 2 years data

how do I get the Specify time ranges
e.g. from 6am to 12pm every days

Thanks for your answer.

0 Karma
1 Solution

dineshraj9
Builder

Just restrict the inbuilt date_hour field to values 6 - 12

index=<your_index> | where date_hour>=6 and date_hour<=12

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi laudai,
in you search insert the following condition:
your_search date_hour>5 | ...

Bye.
Giuseppe

0 Karma

dineshraj9
Builder

Just restrict the inbuilt date_hour field to values 6 - 12

index=<your_index> | where date_hour>=6 and date_hour<=12

niketn
Legend

I would actually pipe to base search rather than additional where clause for two reasons:

1) Filtering records upfront in base search is faster.
2) search fieldName=value is faster than where fieldname=value

index=<your_index> date_hour>=6 and date_hour<=12
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

laudai
Path Finder

Is there has column name date_hour ? I can't use this search so I use Regular Expression

0 Karma

dineshraj9
Builder

date_* default fields are not available for all sources, for instance they are not present for Windows event logs.

https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Usedefaultfields

You can try creating the field like below and then filter -

| eval date_hour=strftime(_time,"%H") | where date_hour>=6 and date_hour<=12

laudai
Path Finder

Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...