Splunk Search

How Can I customize Time

clyde772
Communicator

Hello Gurus!

Here is what I am trying to do. I am trying using Simplified XML, Form to select a certain host and time, that will only analyze selected day's 8:00 - 16:00 time frame data only.

I know you can do this, where I can define into search

date_hour>8 date_hour<18

But when I added this into my form search xml view, the app wouldnt take it.

to summarize

  1. How can I make it so that when the user select a date then it analyze for only that day's 8:00 ~ 16:00 ?

  2. what would be the syntax for defining "every day, 8:00 ~ 16:00" in splunk?

Thanks~!

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

Maybe you're not escaping the < and > characters?

<searchTemplate>... your search here ... date_hour&gt;8 date_hour&lt;18</searchTemplate>

If that's not it, I would post the XML in the question. I'll bet we can figure it out.

sideview
SplunkTrust
SplunkTrust

No problem. Believe me it's a common thing lots of people run into. I Go ahead and can accept my answer and/or vote it up so it'll drop off the 'unanswered questions' page.

0 Karma

clyde772
Communicator

Nick, Thanks!
It worked. How stupid of me. I appreciate it.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...