Filtering query results for specific time range only (without dates or days)

[gautamvbaindur]

Hi, I have a requirement where I need to display results with HTTP status code 503 but want to exclude all results with status code of 503 that occurred between 10pm and 6am for all days (irrespective of days).

For example: index=am_ms_app source="ms_api*" api_status="503 SERVICE_UNAVAILABLE".
I want to display all 503 HTTP status code results that occurred outside of 10pm-6am window.

Any help will be appreciated.
Thanks!

[rnowitzki · Accepted solution]

You could extract the hour of the event to a new field, then filter based on that.

... | eval eventHour=strftime(_time,"%H")
| where eventHour<22 AND eventHour>=6