SPLK-1004: Splunk Core Certified Advanced Power User

Question

Assuming a consistent time zone throughout the environment, which syntax will always return events occurring between 2:00 AM and 5:00 AM?

Explanation

The date_hour default field contains the event hour on a 24-hour scale. Applying date_hour>=2 and date_hour<5 includes hours 2, 3, and 4 while excluding 5, which represents the interval from 2:00 AM up to, but not including, 5:00 AM.

Learn more

Use default fields

SPLK-1004: Splunk Core Certified Advanced Power User

AstroTutor

Notes

Readiness

QuestionQ9

Community Discussion