Getting Data In

query for time

Contributor

I need a query that will extract all log data between (say) 10:00 PM and 10:00 AM. What is the best way to accomplish this?

TIA

Tags (1)
1 Solution

Splunk Employee
Splunk Employee
 index=* earliest=05/16/2011:22:0:0 latest=05/17/2011:10:0:0

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch

Specify absolute time ranges in your search

When searching or saving a search, you can specify time ranges using the following attributes:

earliest=<time_modifier> 
latest=<time_modifier>

For exact time ranges, the syntax of time_modifier is: %m/%d/%Y:%H:%M:%S. For example, to specify a time range from 12AM October 19, 2009 to 12AM October 27, 2009:

earliest=10/19/2009:0:0:0 latest=10/27/2009:0:0:0

If you specify only the "earliest" attribute, "latest" is set to the current time (now) by default. In general, you won't specify "latest" without an "earliest" time.

Important: When you specify a time range in your search or saved search, it overrides the time range that is selected in the dropdown menu. However, the time range specified directly in the search string will not apply to subsearches (but the dropdown selected range will apply).

View solution in original post

Splunk Employee
Splunk Employee
 index=* earliest=05/16/2011:22:0:0 latest=05/17/2011:10:0:0

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch

Specify absolute time ranges in your search

When searching or saving a search, you can specify time ranges using the following attributes:

earliest=<time_modifier> 
latest=<time_modifier>

For exact time ranges, the syntax of time_modifier is: %m/%d/%Y:%H:%M:%S. For example, to specify a time range from 12AM October 19, 2009 to 12AM October 27, 2009:

earliest=10/19/2009:0:0:0 latest=10/27/2009:0:0:0

If you specify only the "earliest" attribute, "latest" is set to the current time (now) by default. In general, you won't specify "latest" without an "earliest" time.

Important: When you specify a time range in your search or saved search, it overrides the time range that is selected in the dropdown menu. However, the time range specified directly in the search string will not apply to subsearches (but the dropdown selected range will apply).

View solution in original post

Splunk Employee
Splunk Employee

That ought to do it.

0 Karma

Motivator

thanks! for the original question example it will be something like

'earliest=@d-2h latest=@d+10' ?

Splunk Employee
Splunk Employee

It does not have to include a date. Relative time modifiers can be used as per the documentation here:

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relat...

so something like 'earliest=@d-2h' specifies 10PM, for example.

Motivator

can earliest only be time or does it have to include date? because the only way i find myself to search time range across differents dates is to use a search which says :

date_hour > 23 OR date_hour < 11 and then select a date range in the dropdown menu