Dashboards & Visualizations

Specify a time window to search during non-business hours

GAurigemma
Engager

Hi All,

I am new to splunk and need some help. I am running a search to look for Doamin Admin account activity. I have the query running right now for failed login attempts for my admin accounts and I am dumping it into a table with the source, destination, count, etc... I would like to run another search for "off-hour" logons. Same search as before, but in this case only look for fails or successes between 7:00PM and 6:00AM each day.

Is this possible?

Any help would be greatly appreciated.

Thanks,
Greg

Tags (1)

mataharry
Communicator

in the search add conditions on the hour of the timestamp (see the fields date_*)

 date_hour<6  OR date_hour>19
0 Karma

hexx
Splunk Employee
Splunk Employee

I think you're going to have to use the date_hour and date_wday fields to satisfy your search needs. The earliest and latest search parameters do not appear to address this case. This might do the trick:

(date_hour>18 OR date_hour<7) OR (date_wday=Sunday OR date_wday=Saturday)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...