Splunk Search

_time is different than timestamp in events, searching by business hours


I have events that with timestamp fields that look like this:

date="6/21/2019 6:50:49 PM"

How do I change my search so that only events during business hours appear? I only want events with timestamps between 6am and 6pm.

I have tried the following:

eval date_hour=strftime(_time, "%w") | search date_hour>=6 date_hour<=18

But the _time field is listed is this

10:51:09.000 AM

As you can see the _time field is about 8 hours earlier than the timestamp in my event and when I search using the _time field, my results are off by 8 hours.

Is there a way to search using the timestamps in my events rather than the _time field? Or can I adjust the _time field to increase by 8 hours so the hours match?

Tags (2)
0 Karma


The time picker only considers _time. You can, however, search for other time fields. Here's one way, but I'm sure there are others.

index=foo | eval ts=strptime(date,"%m/%d/%Y %H:%M:%S %p") 
| eval start=relative_time(ts,"@d+6h"), end=relative_time(ts,"@d+18h")
| search ts>=start AND ts<end
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...