Hello,
i am looking to narrow down my search field, i only want to search for events that happen outside of a specific time range. I want to search for events that happen outside of 0800 to 1700
Any help would be appriceated
Kind regards
Hi @Chris231289
It's useful for these types of queries to understand where the events to be filtered come from and how they look. It also may depend on where you need to filter the data, has it been transformed into a summary already. These things can make a difference to how you would filter out events.
If this is standard search query then by default Splunk creates a data_hour field (from the _time field) so something like this would work...
...your base query search query...
| where ((date_hour < 8 OR (date_hour >= 17))
Maybe provide a sample of you data or your current search query if this does not work for you.
Hope this helps.
thank you but when i put in | where((date_hour < 8 OR (date_hour >= 17)) i get the error Error in 'where' command: The expression is malformed. Expected ).
Looks like i missed the closing parenthesis after the 8. Try...
| where ((date_hour < 8 ) OR (date_hour >= 17))