Comparing hours and minutes TOGETHER

[asarolkar]

I am trying to get records in a certain time range (11:45 AM and 1:45 PM) and I can only rely on date_ hour and date_ minute to be my anchors of division

This search that I came up with is extremely inefficient (and does not work)

sourcetype="syslog" | ... | eval range=case((date_hour>=11 AND date_minute>=45) AND (date_hour<=13  AND date_minute<=45)), "in", ( (date_hour<=11 AND date_minute<=45) OR  (date_hour>13 AND date_minute>45)), "out" )

Any body know of a more useful alternative ?
What if I want to add a date_ month comparison in there as well ?

[yannK · Accepted solution]

Do a simple conversion of the time in minutes (time = hour*60 + minute) and setup a condition

... | eval minute_of_the_day = date_hour*60+date_minute
| eval range=if(minute_of_the_day<(11*60+45),"out",if(minute_of_the_day<=(13*60+45),"in","out"))