Getting Data In

query for time

DTERM
Contributor

I need a query that will extract all log data between (say) 10:00 PM and 10:00 AM. What is the best way to accomplish this?

TIA

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee
 index=* earliest=05/16/2011:22:0:0 latest=05/17/2011:10:0:0

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch

Specify absolute time ranges in your search

When searching or saving a search, you can specify time ranges using the following attributes:

earliest=<time_modifier> 
latest=<time_modifier>

For exact time ranges, the syntax of time_modifier is: %m/%d/%Y:%H:%M:%S. For example, to specify a time range from 12AM October 19, 2009 to 12AM October 27, 2009:

earliest=10/19/2009:0:0:0 latest=10/27/2009:0:0:0

If you specify only the "earliest" attribute, "latest" is set to the current time (now) by default. In general, you won't specify "latest" without an "earliest" time.

Important: When you specify a time range in your search or saved search, it overrides the time range that is selected in the dropdown menu. However, the time range specified directly in the search string will not apply to subsearches (but the dropdown selected range will apply).

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee
 index=* earliest=05/16/2011:22:0:0 latest=05/17/2011:10:0:0

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch

Specify absolute time ranges in your search

When searching or saving a search, you can specify time ranges using the following attributes:

earliest=<time_modifier> 
latest=<time_modifier>

For exact time ranges, the syntax of time_modifier is: %m/%d/%Y:%H:%M:%S. For example, to specify a time range from 12AM October 19, 2009 to 12AM October 27, 2009:

earliest=10/19/2009:0:0:0 latest=10/27/2009:0:0:0

If you specify only the "earliest" attribute, "latest" is set to the current time (now) by default. In general, you won't specify "latest" without an "earliest" time.

Important: When you specify a time range in your search or saved search, it overrides the time range that is selected in the dropdown menu. However, the time range specified directly in the search string will not apply to subsearches (but the dropdown selected range will apply).

jbsplunk
Splunk Employee
Splunk Employee

That ought to do it.

0 Karma

MarioM
Motivator

thanks! for the original question example it will be something like

'earliest=@d-2h latest=@d+10' ?

jbsplunk
Splunk Employee
Splunk Employee

It does not have to include a date. Relative time modifiers can be used as per the documentation here:

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relat...

so something like 'earliest=@d-2h' specifies 10PM, for example.

MarioM
Motivator

can earliest only be time or does it have to include date? because the only way i find myself to search time range across differents dates is to use a search which says :

date_hour > 23 OR date_hour < 11 and then select a date range in the dropdown menu

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...