Splunk Search

Can I Search Multiple TimeRanges in single search

richnavis
Contributor

I would like to create a search that searches between midnight and 1:00am over the last 7 days. Since the data is VERY DENSE, I do not want to search the entire week and then filter the events using eval or Where. Instead, I'd like my search to ONLY return results from those time periods. Is that possible? I know it used to be with the good ol date_* fields, but they are no longer supported in Splunk 5, let along splunk 6. Help anyone?

Tags (2)
0 Karma

bsizemore
Path Finder

I would pipe to a secondary search:

index=* searchterm timespan | search subsearchterm timespan
0 Karma

somesoni2
SplunkTrust
SplunkTrust

date_* fields are supported. Try something like this

your base search date_hour=0

martin_mueller
SplunkTrust
SplunkTrust

Yup, adding date_hour=0 to your initial search run over 7 days is what you need.
It'll be quick because those are indexed fields, resulting in this job inspector output:

DEBUG: base lispy: [ AND index::myindex [ EQ date_hour 0 ] ]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...