Hi, wondering if its possible to exclude data from a search between certain times
| where statuscode > "400"
| timeslice 1s
| count statuscode, _timeslice
| formatdate(_timeslice, "HH:mm:ss") as Time
| where Time NOT > "07:00:00" and < "15:00:00"
| fields -_timeslice
| order by Time asc
Please sign in to leave a comment.