Splunk Search

search command for work time

Explorer

i have one question I want to search time Daily from 9 am to 6:00 pm How can to use search command ?

Thank you for your help

CT

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

If you want to search just one particular day, between 9am and 6pm, do as some others have suggested here and use the relative time syntax:

In the TimeRangePicker pulldown, choose 'Custom time', then 'advanced', then in the two form fields that come up, enter on the left side:

@d+9h 

and enter on the right side

@d+18h

However you have said you want to search this timerange every day. Someone else here has interpreted this to mean you want to run this search once every day as an alert.

However you can search over several days or more but restrict your results to just events during working hours by using the date_hour field like this:

<your search> date_hour>9 date_hour<18

This search can then be run over any timerange (like current business week), and it will match only events that occurred during working hours within that timerange.

More docs and examples about time range arguments can be found here: http://www.splunk.com/base/Documentation/4.1.2/User/ChangeTheTimeRangeOfYourSearch

View solution in original post

Engager

No answer here - I have the same question. I changed the date range through the custom time dropdown box and that works. It gives me events in the correct date range, but not the correct time range. I then added the modifiers below to the query and I get no results.

date_hour>9 date_hour<18

Any suggestions? Trying to limit my search to the previous 5 days between 5am and 9am. I can get the previous 5 days through the dropdown box but I am unable to limit the time range.

SplunkTrust
SplunkTrust

Can you clarify whether you want to a) run your search once per day, and have it search over events from that particular workday, or b) run your search over several days and only match events between 9am and 6pm on those days. Both are possible and both paths are outlined in the answers below

0 Karma

SplunkTrust
SplunkTrust

If you want to search just one particular day, between 9am and 6pm, do as some others have suggested here and use the relative time syntax:

In the TimeRangePicker pulldown, choose 'Custom time', then 'advanced', then in the two form fields that come up, enter on the left side:

@d+9h 

and enter on the right side

@d+18h

However you have said you want to search this timerange every day. Someone else here has interpreted this to mean you want to run this search once every day as an alert.

However you can search over several days or more but restrict your results to just events during working hours by using the date_hour field like this:

<your search> date_hour>9 date_hour<18

This search can then be run over any timerange (like current business week), and it will match only events that occurred during working hours within that timerange.

More docs and examples about time range arguments can be found here: http://www.splunk.com/base/Documentation/4.1.2/User/ChangeTheTimeRangeOfYourSearch

View solution in original post

Path Finder

You can use relative time modifiers in your search term. For your specific question, for a work day of 9am to 6pm, you could specify the following:

earliest=@d+9h latest=@d+18h

Super Champion

Keep in mind that this is a new feature in Splunk 4.1.

0 Karma

Explorer

hi ~ chris

I understand your explanation

Thanks for your help

CT

0 Karma

Explorer

hi ~ chris Thank you for your help if everyday starttime 09:00:00 to endtime 18:0:00 How to use this search command

CT

0 Karma

SplunkTrust
SplunkTrust

it's much better to edit your original question or comment on someone's answer. Posting a comment as an answer to your own question is a little weird - its best to delete this.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!