Splunk Search

extract events for specific time period

remy06
Contributor

I've just configured splunk to index a file that contains events for the last 30 days. Within these events I want to search for all events that fall between 8pm and 8am only.

The format of events are such:

4/30/2012 6:48:32 PM,"xxxxx\xxxxxx","xxxxx",........."
4/30/2012 8:50:30 PM,"xxxxx\xxxxxx","xxxxx",........."
....

Splunk has automatically extracted this field "Date_time" > "4/30/2012 6:48:32 PM"

Any idea?

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Unless they're WinEventLogs, there should also be a field called date_hour, which can be used;

sourcetype=your_sourcetype date_hour > 20 OR date_hour < 8 | ...

EDIT: corrected the hour value

Hope this helps,

Kristian

kristian_kolb
Ultra Champion

oops, see edit above. /k

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...