extract events for specific time period

[remy06]

I've just configured splunk to index a file that contains events for the last 30 days. Within these events I want to search for all events that fall between 8pm and 8am only.

The format of events are such:

4/30/2012 6:48:32 PM,"xxxxx\xxxxxx","xxxxx",........."
4/30/2012 8:50:30 PM,"xxxxx\xxxxxx","xxxxx",........."
....

Splunk has automatically extracted this field "Date_time" > "4/30/2012 6:48:32 PM"

Any idea?

[kristian_kolb]

Unless they're WinEventLogs, there should also be a field called date_hour, which can be used;

sourcetype=your_sourcetype date_hour > 20 OR date_hour < 8 | ...

EDIT: corrected the hour value

Hope this helps,

Kristian

[kristian_kolb]

oops, see edit above. /k