Hi All, I am new to splunk and need some help. I am running a search to look for Doamin Admin account activity. I have the query running right now for failed login attempts for my admin accounts and I am dumping it into a table with the source, destination, count, etc... I would like to run another search for "off-hour" logons. Same search as before, but in this case only look for fails or successes between 7:00PM and 6:00AM each day. Is this possible? Any help would be greatly appreciated. Thanks, Greg ... View more