Splunk Search

How Can I customize Time

clyde772
Communicator

Hello Gurus!

Here is what I am trying to do. I am trying using Simplified XML, Form to select a certain host and time, that will only analyze selected day's 8:00 - 16:00 time frame data only.

I know you can do this, where I can define into search

date_hour>8 date_hour<18

But when I added this into my form search xml view, the app wouldnt take it.

to summarize

  1. How can I make it so that when the user select a date then it analyze for only that day's 8:00 ~ 16:00 ?

  2. what would be the syntax for defining "every day, 8:00 ~ 16:00" in splunk?

Thanks~!

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

Maybe you're not escaping the < and > characters?

<searchTemplate>... your search here ... date_hour&gt;8 date_hour&lt;18</searchTemplate>

If that's not it, I would post the XML in the question. I'll bet we can figure it out.

sideview
SplunkTrust
SplunkTrust

No problem. Believe me it's a common thing lots of people run into. I Go ahead and can accept my answer and/or vote it up so it'll drop off the 'unanswered questions' page.

0 Karma

clyde772
Communicator

Nick, Thanks!
It worked. How stupid of me. I appreciate it.

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...