Reporting

Find event every days betwen 10:50 PM and 01:30 AM

yoan
Explorer

Hello, I didn't find the correct way to search specific events between specific hours.

I want to find since the last 7 day between 10:50 PM and 01:30 AM


Thank's

Labels (1)
0 Karma
1 Solution

rnowitzki
Builder

Hi @yoan ,

Maybe there is a more direct approach, but this should work.

| where date_hour=22 OR date_hour=23 OR date_hour=0 OR date_hour=1 
| where NOT (date_hour=22 and date_minute<50) 
|  where NOT (date_hour=1 and date_minute>30)

 
BR

Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

yoan
Explorer

Thank's it's work

0 Karma

rnowitzki
Builder

Hi @yoan ,

Maybe there is a more direct approach, but this should work.

| where date_hour=22 OR date_hour=23 OR date_hour=0 OR date_hour=1 
| where NOT (date_hour=22 and date_minute<50) 
|  where NOT (date_hour=1 and date_minute>30)

 
BR

Ralph

--
Karma and/or Solution tagging appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...