Splunk Search

Splunk Search: Night Events for all days

angelo82
Explorer

Good Morning I'm looking for collect in Splunk Search all nights event logs between 08:00 PM and 07:00 AM

i've done this one:

'sourcetype="WinEventLog:Security" earliest=@d-4h latest=@d+7h`

and it's good only for last night

what should i do to collect this time range for all days?

i'm using Splunk 4.3.3

My Thanks in Advance

0 Karma
1 Solution

Ayn
Legend

Extract the hour from the timestamp, then check events that match your conditions (very similar to what I answered in your other recent question). Something like this:

... | eval date_hour=strftime(_time, "%H") | search date_hour>=20 OR date_hour<7

View solution in original post

Ayn
Legend

Extract the hour from the timestamp, then check events that match your conditions (very similar to what I answered in your other recent question). Something like this:

... | eval date_hour=strftime(_time, "%H") | search date_hour>=20 OR date_hour<7

View solution in original post

angelo82
Explorer

also this one works perfectly 🙂
thank you more

Regards
Angelo

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!