Splunk Search

search command for work time

shirolu
Explorer

i have one question I want to search time Daily from 9 am to 6:00 pm How can to use search command ?

Thank you for your help

CT

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

If you want to search just one particular day, between 9am and 6pm, do as some others have suggested here and use the relative time syntax:

In the TimeRangePicker pulldown, choose 'Custom time', then 'advanced', then in the two form fields that come up, enter on the left side:

@d+9h 

and enter on the right side

@d+18h

However you have said you want to search this timerange every day. Someone else here has interpreted this to mean you want to run this search once every day as an alert.

However you can search over several days or more but restrict your results to just events during working hours by using the date_hour field like this:

<your search> date_hour>9 date_hour<18

This search can then be run over any timerange (like current business week), and it will match only events that occurred during working hours within that timerange.

More docs and examples about time range arguments can be found here: http://www.splunk.com/base/Documentation/4.1.2/User/ChangeTheTimeRangeOfYourSearch

View solution in original post

jumpe1414
Engager

No answer here - I have the same question. I changed the date range through the custom time dropdown box and that works. It gives me events in the correct date range, but not the correct time range. I then added the modifiers below to the query and I get no results.

date_hour>9 date_hour<18

Any suggestions? Trying to limit my search to the previous 5 days between 5am and 9am. I can get the previous 5 days through the dropdown box but I am unable to limit the time range.

sideview
SplunkTrust
SplunkTrust

Can you clarify whether you want to a) run your search once per day, and have it search over events from that particular workday, or b) run your search over several days and only match events between 9am and 6pm on those days. Both are possible and both paths are outlined in the answers below

0 Karma

sideview
SplunkTrust
SplunkTrust

If you want to search just one particular day, between 9am and 6pm, do as some others have suggested here and use the relative time syntax:

In the TimeRangePicker pulldown, choose 'Custom time', then 'advanced', then in the two form fields that come up, enter on the left side:

@d+9h 

and enter on the right side

@d+18h

However you have said you want to search this timerange every day. Someone else here has interpreted this to mean you want to run this search once every day as an alert.

However you can search over several days or more but restrict your results to just events during working hours by using the date_hour field like this:

<your search> date_hour>9 date_hour<18

This search can then be run over any timerange (like current business week), and it will match only events that occurred during working hours within that timerange.

More docs and examples about time range arguments can be found here: http://www.splunk.com/base/Documentation/4.1.2/User/ChangeTheTimeRangeOfYourSearch

sajbutler
Path Finder

You can use relative time modifiers in your search term. For your specific question, for a work day of 9am to 6pm, you could specify the following:

earliest=@d+9h latest=@d+18h

Lowell
Super Champion

Keep in mind that this is a new feature in Splunk 4.1.

0 Karma

shirolu
Explorer

hi ~ chris

I understand your explanation

Thanks for your help

CT

0 Karma

shirolu
Explorer

hi ~ chris Thank you for your help if everyday starttime 09:00:00 to endtime 18:0:00 How to use this search command

CT

0 Karma

sideview
SplunkTrust
SplunkTrust

it's much better to edit your original question or comment on someone's answer. Posting a comment as an answer to your own question is a little weird - its best to delete this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...