Search Query Help!

[kc_prane]

Hello, I am looking for my search results for only 6pm to 9pm over the last 90 days. How can I achieve this with the below query?

index=* host=*  | eval pctCPU=if(CPU="all",100-pctIdle,Value) | timechart  avg(pctCPU) AS avgCPU BY host

[richgalloway]

Try filtering the results on the date_hour field.

index=* host=*  
| where date_hour>=18 AND date_hour<21
| eval pctCPU=if(CPU="all",100-pctIdle,Value) 
| timechart  avg(pctCPU) AS avgCPU BY host