Splunk Search

How Can I customize Time

clyde772
Communicator

Hello Gurus!

Here is what I am trying to do. I am trying using Simplified XML, Form to select a certain host and time, that will only analyze selected day's 8:00 - 16:00 time frame data only.

I know you can do this, where I can define into search

date_hour>8 date_hour<18

But when I added this into my form search xml view, the app wouldnt take it.

to summarize

  1. How can I make it so that when the user select a date then it analyze for only that day's 8:00 ~ 16:00 ?

  2. what would be the syntax for defining "every day, 8:00 ~ 16:00" in splunk?

Thanks~!

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

Maybe you're not escaping the < and > characters?

<searchTemplate>... your search here ... date_hour&gt;8 date_hour&lt;18</searchTemplate>

If that's not it, I would post the XML in the question. I'll bet we can figure it out.

sideview
SplunkTrust
SplunkTrust

No problem. Believe me it's a common thing lots of people run into. I Go ahead and can accept my answer and/or vote it up so it'll drop off the 'unanswered questions' page.

0 Karma

clyde772
Communicator

Nick, Thanks!
It worked. How stupid of me. I appreciate it.

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...