Splunk Search

Can I Search Multiple TimeRanges in single search


I would like to create a search that searches between midnight and 1:00am over the last 7 days. Since the data is VERY DENSE, I do not want to search the entire week and then filter the events using eval or Where. Instead, I'd like my search to ONLY return results from those time periods. Is that possible? I know it used to be with the good ol date_* fields, but they are no longer supported in Splunk 5, let along splunk 6. Help anyone?

Tags (2)
0 Karma

Path Finder

I would pipe to a secondary search:

index=* searchterm timespan | search subsearchterm timespan
0 Karma

Revered Legend

date_* fields are supported. Try something like this

your base search date_hour=0


Yup, adding date_hour=0 to your initial search run over 7 days is what you need.
It'll be quick because those are indexed fields, resulting in this job inspector output:

DEBUG: base lispy: [ AND index::myindex [ EQ date_hour 0 ] ]
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...