Splunk Enterprise

Filtering query results for specific time range only (without dates or days)

gautamvbaindur
New Member

Hi, I have a requirement where I need to display results with HTTP status code 503 but want to exclude all results with status code of 503 that occurred between 10pm and 6am for all days (irrespective of days).

For example: index=am_ms_app source="ms_api*" api_status="503 SERVICE_UNAVAILABLE".
I want to display all 503 HTTP status code results that occurred outside of 10pm-6am window.

Any help will be appreciated.
Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

rnowitzki
Builder

You could extract the hour of the event to a new field, then filter based on that.

... | eval eventHour=strftime(_time,"%H")
| where eventHour<22 AND eventHour>=6
--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

You could extract the hour of the event to a new field, then filter based on that.

... | eval eventHour=strftime(_time,"%H")
| where eventHour<22 AND eventHour>=6
--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...