How to search for data per month, but only within a certain time frame (07:30 - 12:00)?

[smart_r]

I would like to extract data per month, but only within a certain time frame.

Say: Extract all data from January, but only within the time frame 07:30 - 12:00.

Thanks in advance.

[somesoni2 · Accepted solution]

See this similar question.

https://answers.splunk.com/answers/351237/run-a-monthly-performance-report-excluding-mainten.html#an...

Basically, you can use use date_hour and data_minute fields (if available already) to filter events. If they are not available, you can calculate them (from _time) and use the calculated values to filter events.

[smart_r]

Thank you kindly for your reply. This must help 🙂