Solved: Search date range that returns last 4 full hours

mbtsoltis · ‎11-26-2021

Is it possible to do a search that returns the last 4 full hours? Meaning, if it is 5:13 PM it would return results between 1:00 PM and 5:00 PM (filters out off the current hour)

Thanks in advance for any responses

richgalloway · ‎11-26-2021

Yes, it is possible and easy.

index=foo earliest=-4h@h latest=@h

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎11-26-2021

Yes, it is possible and easy.

index=foo earliest=-4h@h latest=@h

---
If this reply helps you, Karma would be appreciated.

Search date range that returns last 4 full hours

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Splunk Community Badges!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Join the Conversation