Can I Search Multiple TimeRanges in single search

[richnavis]

I would like to create a search that searches between midnight and 1:00am over the last 7 days. Since the data is VERY DENSE, I do not want to search the entire week and then filter the events using eval or Where. Instead, I'd like my search to ONLY return results from those time periods. Is that possible? I know it used to be with the good ol date_* fields, but they are no longer supported in Splunk 5, let along splunk 6. Help anyone?

[bsizemore]

I would pipe to a secondary search:

index=* searchterm timespan | search subsearchterm timespan

[somesoni2]

date_* fields are supported. Try something like this

your base search date_hour=0

[martin_mueller]

Yup, adding date_hour=0 to your initial search run over 7 days is what you need.
It'll be quick because those are indexed fields, resulting in this job inspector output:

DEBUG: base lispy: [ AND index::myindex [ EQ date_hour 0 ] ]