Splunk Search

Can I Search Multiple TimeRanges in single search

richnavis
Contributor

I would like to create a search that searches between midnight and 1:00am over the last 7 days. Since the data is VERY DENSE, I do not want to search the entire week and then filter the events using eval or Where. Instead, I'd like my search to ONLY return results from those time periods. Is that possible? I know it used to be with the good ol date_* fields, but they are no longer supported in Splunk 5, let along splunk 6. Help anyone?

Tags (2)
0 Karma

bsizemore
Path Finder

I would pipe to a secondary search:

index=* searchterm timespan | search subsearchterm timespan
0 Karma

somesoni2
Revered Legend

date_* fields are supported. Try something like this

your base search date_hour=0

martin_mueller
SplunkTrust
SplunkTrust

Yup, adding date_hour=0 to your initial search run over 7 days is what you need.
It'll be quick because those are indexed fields, resulting in this job inspector output:

DEBUG: base lispy: [ AND index::myindex [ EQ date_hour 0 ] ]
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...