Splunk Search

Display Events Within a Specific Time Range

shingdayho
Explorer

Hello,

I want to create a report which currently shows me the events by hour. I want to change these to only between 22:00-08:00. Is there anyway to set in the search to only show results within those hours or specify which hours you want to see results for?

Thanks,

Tags (2)
0 Karma

shingdayho
Explorer

My report shows events per hour, example:

22:00 - 10
23:00 - 7
00:00 - 3
01:00 - 2

I want it to show data only for hours 22:00 to 08:00. I do not want to see anything from 09:00 to 21:00.

0 Karma

vasanthmss
Motivator

try to add earliest and latest in your query as explained below. is it working?

V
0 Karma

vasanthmss
Motivator

Hi,

As you said you want a report that will summarize hourly events(as of now 24h) you want specific duration like 00:00 to 8:00. Suppose you have scheduled your report at 9.00 AM then you can calculate your required time duration like this earliest=-9h@h latest=-1h@h. Like the above calculation you can change the earliest and latest as per your scheduled timing.

the search will be,

index=_internal earliest=-9h@h latest=-1h@h | timechart span=1h count

Cheers!

V
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...