Question about time searches

[Antioch]

Hello splunk community, I'm brand new at using the software and I seem to run into a point that I cant find any documentation to cover. Basically what I'm trying to do is create a search string that pulls logons before a certain time and after a certain time, and that also pulls all logins on Saturday and Sunday. In the search manual and in the search reference I found the search terms earliestand latest, but these correspond to when the search was run, not the actual time of the log. Can anyone give me a hand with this?

[sdaniels · Accepted solution]

It sounds like you want to do something like this:

http://splunk-base.splunk.com/answers/54981/specify-a-time-window-to-search-during-non-business-hour...

The time modifiers will apply to the timestamp for your actual events. Therefore, you can specify a search with earliest=-2d@d latest=-1d@d to only look at data based on your search for 2 days ago only or earliest=@w0 to search events since the beginning of the current week.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/SearchTimeModifiers

[Antioch]

That's exactly what I was looking for thanks!