Splunk Enterprise Security

How to customize date/time range in search?

itsmevic
Communicator

Hello,

Rather than run three separate reports on three different dates, I'd like to run ONE report that only encapsulates the following dates:

May 9, 2020, May 16, 2020, and May 23, 2020, and I'd like to search those days between the times 11:00 AM to 1:00 PM.

Thank you for your help!

Example of my search I'd like to incorporate it in:

*"IP Address" OR "IP Address" OR "IP Address"
| timechart count by src
| sort -count*
Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You could use a series of append commands, but that's pretty much like running 3 searches.

Perhaps this will do what you want. It uses hard-coded dates since that is what you asked for. Run it with a time window starting early on 9 May 20.

index=foo "IP Address" OR "IP Address" OR "IP Address"
| where (_time >= strptime("May 9, 2020 11:00 AM", "%b %d, %Y %H:%M %p") AND _time <= strptime("May 9, 2020 1:00 PM", "%b %d, %Y %H:%M %p")) 
  OR (_time >= strptime("May 16, 2020 11:00 AM", "%b %d, %Y %H:%M %p") AND _time <= strptime("May 16, 2020 1:00 PM", "%b %d, %Y %H:%M %p")) 
  OR (_time >= strptime("May 23, 2020 11:00 AM", "%b %d, %Y %H:%M %p") AND _time <= strptime("May 23, 2020 1:00 PM", "%b %d, %Y %H:%M %p"))
| timechart count by src
| sort - count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You could use a series of append commands, but that's pretty much like running 3 searches.

Perhaps this will do what you want. It uses hard-coded dates since that is what you asked for. Run it with a time window starting early on 9 May 20.

index=foo "IP Address" OR "IP Address" OR "IP Address"
| where (_time >= strptime("May 9, 2020 11:00 AM", "%b %d, %Y %H:%M %p") AND _time <= strptime("May 9, 2020 1:00 PM", "%b %d, %Y %H:%M %p")) 
  OR (_time >= strptime("May 16, 2020 11:00 AM", "%b %d, %Y %H:%M %p") AND _time <= strptime("May 16, 2020 1:00 PM", "%b %d, %Y %H:%M %p")) 
  OR (_time >= strptime("May 23, 2020 11:00 AM", "%b %d, %Y %H:%M %p") AND _time <= strptime("May 23, 2020 1:00 PM", "%b %d, %Y %H:%M %p"))
| timechart count by src
| sort - count
---
If this reply helps you, Karma would be appreciated.

itsmevic
Communicator

As always, a big thank you, Rich!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...