Reporting

Find event every days betwen 10:50 PM and 01:30 AM

yoan
Explorer

Hello, I didn't find the correct way to search specific events between specific hours.

I want to find since the last 7 day between 10:50 PM and 01:30 AM


Thank's

Labels (1)
0 Karma
1 Solution

rnowitzki
Builder

Hi @yoan ,

Maybe there is a more direct approach, but this should work.

| where date_hour=22 OR date_hour=23 OR date_hour=0 OR date_hour=1 
| where NOT (date_hour=22 and date_minute<50) 
|  where NOT (date_hour=1 and date_minute>30)

 
BR

Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

yoan
Explorer

Thank's it's work

0 Karma

rnowitzki
Builder

Hi @yoan ,

Maybe there is a more direct approach, but this should work.

| where date_hour=22 OR date_hour=23 OR date_hour=0 OR date_hour=1 
| where NOT (date_hour=22 and date_minute<50) 
|  where NOT (date_hour=1 and date_minute>30)

 
BR

Ralph

--
Karma and/or Solution tagging appreciated.
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...