Create a interval query for LogSearch

InsightIDR
1

I need to create a range for a query, but my payload doesn’t separate the time from the date, which means I can’t extract just the time.

I need a query that has a timestamp < 7 or > 18. (hours)

Sample from my timestamp

“timestamp”: “2025-04-15T14:14:11.000Z”,

Can anyone help?

2

@rferreira1 you’d need to capture group the hour value to compare it using regex or use an explicit list like this using a contains

timestamp CONTAINS [“T06”,“T05”,“T04”,“T03”,“T02”,“T01”,“T00”,“T23”,“T22”,“T21”,“T20”,“T19”]

David