How do I extract the second from _time?

[ddrillic]

How do I find whether the time stamp of an event covers a specific second within a day? So, we need to identify all the events for, let’s say, the second at the interval of 11:12:50 - 11:12:51.

Something like | eval mytime=strftime(_time, "%d") but for the second...

[adonio · Accepted solution]

hello there,
hope i understood your question,
maybe use earliest and latest?
http://docs.splunk.com/Documentation/Splunk/6.6.2/Search/Specifytimemodifiersinyoursearch
for example:
index = * sourcetype = * earliest = 7/31/2017:11:19:51 latest = 7/31/2017:11:19:52
you can also use the gui time picker for that

[ddrillic]

I see - the thing is that we have a long list of seconds we want to look at....

[ddrillic]

Perfect @adonio !!!

The following seems to work -

(earliest = 7/20/2017:20:00:00 latest = 7/20/2017:20:00:01) OR
(earliest = 7/20/2017:21:00:00 latest = 7/20/2017:21:00:01) ....

[mwirth_splunk]

Use the default field date_second.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/Usedefaultfields#date_second

[ddrillic]

Thank you for all you help!