I have a field timeofevent which contains the time at which the event was logged in 24 hour format.
Format of timeofevent: HH:MM
I want only the events which were logged between 18:30 to 08:30 CST.
Try this
| where timeofevent>="18:30" OR timeofevent<="08:30"
hi @ITWhisperer
Shouldn't it be?
| where timeofevent>="18:30" AND timeofevent<="08:30"
Only if you want no results!
Splunk works on a pipeline of event, each event is processed separately, so an event cannot be both >18:30 and <08:30 at the same time
By using
it is returning all the events, even the ones which are outside of that timeframe
You probably need to convert the string to a number e.g. "18:30" becomes 1830 and "08:30" becomes 830
| eval timeofevent=tonumber(replace(timeofevent,":",""),10) | where timeofevent>=1830 OR timeofevent<=830
