https://community.splunk.com/t5/Getting-Data-In/How-to-create-custom-relative-date-and-time-in-Splunk/m-p/429017#M75172 <P>Hi,</P> <P>I have lot of alerts which even trigger during the maintenance period causing false incidents. The cmdb has the maintenance schedule but in the formats like <STRONG>"1st&amp;3rd-Friday@10am"</STRONG>, <STRONG>"2nd&amp;4th-Monday@6pm"</STRONG> and so on. I am trying to prase this time in Splunk search query so that i can create Starttime &amp; Endtime for which the alert will not trigger.</P> <P>I am able to <STRONG>"| eval CurrentDay = strftime(now(), "%A")"</STRONG> which gives me the current day like whether today is Monday/Tuesday or what day, but how do i find out if it is first monday of the month or 2nd monday or so for me to address this requirement.</P> <P>Anyone who can point me towards some direction in addressing this?</P> Tue, 12 Mar 2019 08:52:46 GMT ashish9433 2019-03-12T08:52:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-custom-relative-date-and-time-in-Splunk/m-p/429017#M75172 <P>Hi,</P> <P>I have lot of alerts which even trigger during the maintenance period causing false incidents. The cmdb has the maintenance schedule but in the formats like <STRONG>"1st&amp;3rd-Friday@10am"</STRONG>, <STRONG>"2nd&amp;4th-Monday@6pm"</STRONG> and so on. I am trying to prase this time in Splunk search query so that i can create Starttime &amp; Endtime for which the alert will not trigger.</P> <P>I am able to <STRONG>"| eval CurrentDay = strftime(now(), "%A")"</STRONG> which gives me the current day like whether today is Monday/Tuesday or what day, but how do i find out if it is first monday of the month or 2nd monday or so for me to address this requirement.</P> <P>Anyone who can point me towards some direction in addressing this?</P> Tue, 12 Mar 2019 08:52:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-custom-relative-date-and-time-in-Splunk/m-p/429017#M75172 ashish9433 2019-03-12T08:52:46Z