Splunk Search

Search Query Help!

kc_prane
Communicator

Hello, I am looking for my search results for only 6pm to 9pm over the last 90 days. How can I achieve this with the below query?

index=* host=*  | eval pctCPU=if(CPU="all",100-pctIdle,Value) | timechart  avg(pctCPU) AS avgCPU BY host
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try filtering the results on the date_hour field.

index=* host=*  
| where date_hour>=18 AND date_hour<21
| eval pctCPU=if(CPU="all",100-pctIdle,Value) 
| timechart  avg(pctCPU) AS avgCPU BY host
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...