Splunk Search

Filtering by 24h time in splunk

priyangshupal
Engager

I have a field timeofevent which contains the time at which the event was logged in 24 hour format.

Format of timeofevent: HH:MM

I want only the events which were logged between 18:30 to 08:30 CST.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

 

| where timeofevent>="18:30" OR timeofevent<="08:30"

 

0 Karma

priyangshupal
Engager

hi @ITWhisperer 

Shouldn't it be?

 

| where timeofevent>="18:30" AND timeofevent<="08:30"

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Only if you want no results!

Splunk works on a pipeline of event, each event is processed separately, so an event cannot be both >18:30 and <08:30 at the same time

0 Karma

priyangshupal
Engager

By using

| where timeofevent>="18:30" OR timeofevent<="08:30"

it is returning all the events, even the ones which are outside of that timeframe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You probably need to convert the string to a number e.g. "18:30" becomes 1830 and "08:30" becomes 830

| eval timeofevent=tonumber(replace(timeofevent,":",""),10)
| where timeofevent>=1830 OR timeofevent<=830

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...