Splunk Search

How to search for data per month, but only within a certain time frame (07:30 - 12:00)?

New Member

I would like to extract data per month, but only within a certain time frame.

Say: Extract all data from January, but only within the time frame 07:30 - 12:00.

Thanks in advance.

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

See this similar question.

https://answers.splunk.com/answers/351237/run-a-monthly-performance-report-excluding-mainten.html#an...

Basically, you can use use datehour and dataminute fields (if available already) to filter events. If they are not available, you can calculate them (from _time) and use the calculated values to filter events.

View solution in original post

SplunkTrust
SplunkTrust

See this similar question.

https://answers.splunk.com/answers/351237/run-a-monthly-performance-report-excluding-mainten.html#an...

Basically, you can use use datehour and dataminute fields (if available already) to filter events. If they are not available, you can calculate them (from _time) and use the calculated values to filter events.

View solution in original post

New Member

Thank you kindly for your reply. This must help 🙂

0 Karma