Splunk Search

_time is different than timestamp in events, searching by business hours


I have events that with timestamp fields that look like this:

date="6/21/2019 6:50:49 PM"

How do I change my search so that only events during business hours appear? I only want events with timestamps between 6am and 6pm.

I have tried the following:

eval date_hour=strftime(_time, "%w") | search date_hour>=6 date_hour<=18

But the _time field is listed is this

10:51:09.000 AM

As you can see the _time field is about 8 hours earlier than the timestamp in my event and when I search using the _time field, my results are off by 8 hours.

Is there a way to search using the timestamps in my events rather than the _time field? Or can I adjust the _time field to increase by 8 hours so the hours match?

Tags (2)
0 Karma


The time picker only considers _time. You can, however, search for other time fields. Here's one way, but I'm sure there are others.

index=foo | eval ts=strptime(date,"%m/%d/%Y %H:%M:%S %p") 
| eval start=relative_time(ts,"@d+6h"), end=relative_time(ts,"@d+18h")
| search ts>=start AND ts<end
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...