Dashboards & Visualizations

Select Time Range

laudai
Path Finder

He guys
I have 2 years data

how do I get the Specify time ranges
e.g. from 6am to 12pm every days

Thanks for your answer.

0 Karma
1 Solution

dineshraj9
Builder

Just restrict the inbuilt date_hour field to values 6 - 12

index=<your_index> | where date_hour>=6 and date_hour<=12

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi laudai,
in you search insert the following condition:
your_search date_hour>5 | ...

Bye.
Giuseppe

0 Karma

dineshraj9
Builder

Just restrict the inbuilt date_hour field to values 6 - 12

index=<your_index> | where date_hour>=6 and date_hour<=12

niketn
Legend

I would actually pipe to base search rather than additional where clause for two reasons:

1) Filtering records upfront in base search is faster.
2) search fieldName=value is faster than where fieldname=value

index=<your_index> date_hour>=6 and date_hour<=12
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

laudai
Path Finder

Is there has column name date_hour ? I can't use this search so I use Regular Expression

0 Karma

dineshraj9
Builder

date_* default fields are not available for all sources, for instance they are not present for Windows event logs.

https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Usedefaultfields

You can try creating the field like below and then filter -

| eval date_hour=strftime(_time,"%H") | where date_hour>=6 and date_hour<=12

laudai
Path Finder

Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...