I have a field timeofevent which contains the time at which the event was logged in 24 hour format.
Format of timeofevent: HH:MM
I want only the events which were logged between 18:30 to 08:30 CST.
Try this
| where timeofevent>="18:30" OR timeofevent<="08:30"
Only if you want no results!
Splunk works on a pipeline of event, each event is processed separately, so an event cannot be both >18:30 and <08:30 at the same time
By using
| where timeofevent>="18:30" OR timeofevent<="08:30"
it is returning all the events, even the ones which are outside of that timeframe
You probably need to convert the string to a number e.g. "18:30" becomes 1830 and "08:30" becomes 830
| eval timeofevent=tonumber(replace(timeofevent,":",""),10)
| where timeofevent>=1830 OR timeofevent<=830