Splunk Search

How to create a 14 day search for specific time range (02:00 - 06:00) only?

ashidhingra
Path Finder

How to create a 14 day search for specific time range (02:00 - 06:00) only?

 

 

Labels (5)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can either set up the search with multiple ranges in the search string, i.e.

index=... criteria=...
 ((earliest=@d+2h latest=@d+6h) OR 
  (earliest=-d@d+2h latest=-d@d+6h) OR 
  (earliest=-2d@d+2h latest=-2d@d+6h) OR 
  (earliest=-3d@d+2h latest=-3d@d+6h) OR 
  (earliest=-4d@d+2h latest=-4d@d+6h) OR 
  (earliest=-5d@d+2h latest=-5d@d+6h) OR 
  (earliest=-6d@d+2h latest=-6d@d+6h) OR 
  (earliest=-7d@d+2h latest=-7d@d+6h) OR 
  (earliest=-8d@d+2h latest=-8d@d+6h) OR 
  (earliest=-9d@d+2h latest=-9d@d+6h) OR 
  (earliest=-10d@d+2h latest=-10d@d+6h) OR 
  (earliest=-11d@d+2h latest=-11d@d+6h) OR 
  (earliest=-12d@d+2h latest=-12d@d+6h) OR 
  (earliest=-13d@d+2h latest=-13d@d+6h) OR 
  (earliest=-14d@d+2h latest=-14d@d+6h))
...

or you can search for 2 weeks of data and then filter the appropriate time ranges out you want.

View solution in original post

ashidhingra
Path Finder

Is there a way to only show the time of the query on the timechart

ashidhingra_0-1658237241997.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I don't believe you can remove the 6am-2am regions from the chart, but you might want to look at the timewrap command

https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Timewrap

which would allow you to plot all points one the same chart 2am-6am of the current day and to show the other days in the same time slot, but as different data series.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ashidhingra,

if you have the time_hour field, you could use a search like this:

index=your_index earliest=-14d@d latest=@d (time_hour>1 time_hour<7)
| ...

if you haven't this field, you have to extract it

index=your_index earliest=-14d@d latest=@d 
| eval time_hour=strftime(_time,"H")
| where (time_hour>1 AND time_hour<7)
| ...

Ciao.

Giuseppe

bowesmana
SplunkTrust
SplunkTrust

You can either set up the search with multiple ranges in the search string, i.e.

index=... criteria=...
 ((earliest=@d+2h latest=@d+6h) OR 
  (earliest=-d@d+2h latest=-d@d+6h) OR 
  (earliest=-2d@d+2h latest=-2d@d+6h) OR 
  (earliest=-3d@d+2h latest=-3d@d+6h) OR 
  (earliest=-4d@d+2h latest=-4d@d+6h) OR 
  (earliest=-5d@d+2h latest=-5d@d+6h) OR 
  (earliest=-6d@d+2h latest=-6d@d+6h) OR 
  (earliest=-7d@d+2h latest=-7d@d+6h) OR 
  (earliest=-8d@d+2h latest=-8d@d+6h) OR 
  (earliest=-9d@d+2h latest=-9d@d+6h) OR 
  (earliest=-10d@d+2h latest=-10d@d+6h) OR 
  (earliest=-11d@d+2h latest=-11d@d+6h) OR 
  (earliest=-12d@d+2h latest=-12d@d+6h) OR 
  (earliest=-13d@d+2h latest=-13d@d+6h) OR 
  (earliest=-14d@d+2h latest=-14d@d+6h))
...

or you can search for 2 weeks of data and then filter the appropriate time ranges out you want.

burwell
SplunkTrust
SplunkTrust

I think you would have to carefully craft a string of earliestTime >= and latestTime <= for all the four hour time slots over the past 14 days.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...