Splunk Search

How to search for loggins outside a specified time range?

scootsblue48
New Member

Hi,

I have been looking to see if splunk has the capability of searching for loggins outside of a specified set time range on windows and linux systems. What I mean by this is that I am looking to see loggings that only happen before, lets say, 0600 and after 1600. any information that i can get would be much appreciated.

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I think you are looking for strftime.  In the following, I'll also use relative_time to simplify the logic.

| eval shour = strftime(relative_time(_time, "+8h"), "%H") ``` push start to zero ```
| where shour < 15

Hope this helps. 

Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Splunk can search for almost anything (some searches are simply easier done than others). It's about what kind of data you have in your Splunk. Remember that Splunk searches data it has stored in its indexes so you first have to feed the data from various systems to splunk. If you do that, then yes, it can perform such searches if your data is properly onboarded.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...