How can I achieve the query for retrieving data for a particular time for the last 6 days?

[Subarna]

How can I achieve the query for retrieving data for a particular time for the last 6 days? Suppose I want to get the data for last 6 days from time 12.00 A.M to 4.00 P.M. Please help on the same

[gcusello]

Hi @Subarna,

you have to run a search for the full period adding a filter on the hosu, something like this:

index=your_index earliest=-6d@d latest=@d (date_hour>11 date_hour<17)
| ...

if you haven't date _hour, you have to extract it:

index=your_index earliest=-6d@d latest=@d 
| eval date_hour=strftime(_time,"%H")
| where date_hour>11 AND date_hour<17
| ...

Ciao.

Giuseppe