Splunk Search

## Comparing hours and minutes TOGETHER

Builder

I am trying to get records in a certain time range (11:45 AM and 1:45 PM) and I can only rely on date_ hour and date_ minute to be my anchors of division

This search that I came up with is extremely inefficient (and does not work)

sourcetype="syslog" | ... | eval range=case((date_hour>=11 AND date_minute>=45) AND (date_hour<=13  AND date_minute<=45)), "in", ( (date_hour<=11 AND date_minute<=45) OR  (date_hour>13 AND date_minute>45)), "out" )

Any body know of a more useful alternative ?
What if I want to add a date_ month comparison in there as well ?

Tags (4)
1 Solution
Splunk Employee

Do a simple conversion of the time in minutes (time = hour*60 + minute) and setup a condition

... | eval minute_of_the_day = date_hour*60+date_minute
| eval range=if(minute_of_the_day<(11*60+45),"out",if(minute_of_the_day<=(13*60+45),"in","out"))

Splunk Employee

Do a simple conversion of the time in minutes (time = hour*60 + minute) and setup a condition

... | eval minute_of_the_day = date_hour*60+date_minute
| eval range=if(minute_of_the_day<(11*60+45),"out",if(minute_of_the_day<=(13*60+45),"in","out"))

Get Updates on the Splunk Community!

#### Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

#### Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

#### Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...