What SPL Syntax Returns Events Between 2:00 AM and 5:00 AM?
Assuming a standard time zone across the environment, what syntax will always return events from between 2:00am and 5:00am?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you know to filter on the automatically extracted date_hour field, not whether you can apply relative time modifiers like earliest/latest.
To filter events between two specific hours in Splunk, you can use the date_hour field with comparison operators. Community consensus confirms answer A is correct, despite a typo in the exam option where the underscore in date_hour is missing.
A common mistake is selecting a malformed earliest/latest option (like D) because it appears to define a time range, but the correct and reliable method is using date_hour with >= and < on the event's timestamp field.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A uses date_hour>=2 AND date_hour<5, which leverages Splunk's automatically extracted date_hour field representing the hour in 24-hour format. This returns events whose hour is 2, 3, or 4 — exactly the 2:00 AM to 4:59 AM period. The community correctly points out that the printed option is missing the underscore, but the intended answer is clearly A.
Why the Other Options Are Wrong
Option B (earliest==2h@h AND latests-5h@h) uses relative time modifiers but has syntax errors and also would not guarantee an absolute between-2-and-5 filter. Option C (time_hour>=2 AND time_hour>=5) uses a non-existent field and contradictory logic. Option D (earliest-2h@h AND latest=5h@h) is a malformed attempt at using earliest/latest; it lacks proper = syntax and does not map to a fixed hour-of-day range.
Community Comment Notes
Comments overwhelmingly support A, with users noting the typo: "The correct answer is: A. date hour>=2 AND date_hour<5 There is a typo, missing the _ in the date_hour." Another comment says, "I think there is a typo, the correct answer is A. It's just missing the _ from the statement." These comments reinforce that the exam option is a typo and that the intended correct answer is the date_hour field-based filter.
Official Reference
Exam Strategy
Remember that Splunk automatically extracts a date_hour field for every event. For questions about a fixed wall-clock hour range, use date_hour with comparison operators, not earliest/latest, which are for relative or absolute time ranges at search time.
Related Analysis
Practice All SPLK-1004 Questions
Access 130 questions with complete answers and detailed explanations.
View Full SPLK-1004 Practice Test →