Splunk Search

How do I search across a specific or custom time range within each hour of the day?

maverick
Splunk Employee
Splunk Employee

I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment around the top of every hour, but I am not sure what it is yet. So I would like to narrow my scheduled search time range down to only search a few minutes before and a few minutes after each hour of the day.

1 Solution

maverick
Splunk Employee
Splunk Employee

You could try this:

(your search terms here) AND (date_minute >= 50 OR date_minute < 10)

This search will find all events that match your specific search terms while narrowing down the time range between the last ten minutes of the last hour and the first ten minutes of the next hour, like you are wanting.

View solution in original post

maverick
Splunk Employee
Splunk Employee

You could try this:

(your search terms here) AND (date_minute >= 50 OR date_minute < 10)

This search will find all events that match your specific search terms while narrowing down the time range between the last ten minutes of the last hour and the first ten minutes of the next hour, like you are wanting.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...