Specific time of the day search for the past 6 months

[karambaz]

Hi There,

Currently I'm using Splunk 4.3.

Need help on how to write a query to specify a timeframe so that i get data for every day 12AM to 6 AM for the last 6 months.

[MuS]

Hi karambaz,

try something like this:

your base search earliest=-6mon date_hour<=06

this will return all events between 12AM and 6AM, this is because 12AM is searchable as date_hour=00 within Splunk.

hope this helps ...

cheers, MuS