How do I search across a specific or custom time range within each hour of the day?

[maverick]

I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment around the top of every hour, but I am not sure what it is yet. So I would like to narrow my scheduled search time range down to only search a few minutes before and a few minutes after each hour of the day.

[maverick · Accepted solution]

You could try this:

(your search terms here) AND (date_minute >= 50 OR date_minute < 10)

This search will find all events that match your specific search terms while narrowing down the time range between the last ten minutes of the last hour and the first ten minutes of the next hour, like you are wanting.