How to narrow down data with time?

[Chris231289]

Hello, 

i am looking to narrow down my search field, i only want to search for events that happen outside of  a specific time range. I want to search for events that happen outside of 0800 to 1700

Any help would be appriceated 

Kind regards 

[yeahnah]

Hi @Chris231289 

It's useful for these types of queries to understand where the events to be filtered come from and how they look.  It also may depend on where you need to filter the data, has it been transformed into a summary already.  These things can make a difference to how you would filter out events. 

If this is standard search query then by default Splunk creates a data_hour field (from the _time field) so something like this would work...

...your base query search query...
| where ((date_hour < 8 OR (date_hour >= 17))

Maybe provide a sample of you data or your current search query if this does not work for you. 
 
Hope this helps.

[Chris231289]

thank you but when i put in | where((date_hour < 8 OR (date_hour >= 17))  i get the error Error in 'where' command: The expression is malformed. Expected ).

[yeahnah]

Looks like i missed the closing parenthesis after the 8.  Try...
 
| where  ((date_hour < 8 ) OR (date_hour >= 17))