Can we specify cron schedule in the live search

[xvxt006]

Hi,

i would like to exclude certain time ranges over a period of time when i am doing a live search. Can i do that? For example i want to include only from 8 am to 5 pm. how can i do that?

[somesoni2 · Accepted solution]

You can use splunk provided date_* fields for that. Something like this should work

your base search (date_hour>=8 AND date_hour<=17)