topic Manage data for Sunday in Alerting

topic Manage data for Sunday in Alerting https://community.splunk.com/t5/Alerting/Manage-data-for-Sunday/m-p/532589#M10046 <P>Hello,I have this query..</P><P>index="dpsn_students" earliest=0 latest=now suspended=false AND (class= "*" OR class= "* *")<BR />| dedup primaryEmail<BR />| rename primaryEmail as email<BR />| eval class=upper(class)<BR />| join type=outer email<BR />[ search index="dpsn_meet"<BR />| rex field=date "(?<yy>[^\.]*)\-(?<mm>[^\.]*)\-(?<dd>[\S]*)T(?<hh>[^\.]*)\:(?<min>[^\.]*)\:(?<sec>[^\.]*)\."<BR />| eval ndatetime = yy.mm.dd.hh.min.sec<BR />| eval _time=strptime(ndatetime,"%Y%m%d%H%M%S") + 19800<BR />| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S")<BR />| eval Duration = duration_seconds/60<BR />| stats sum(Duration) as tot by email]<BR />| join type=outer class<BR />[ search index="dpsnapitt" AND (class= "*" OR class= "* *") AND day="DAY 1" | stats count as Total by class<BR />| eval class_time=Total*30]<BR />| fillnull value="0"<BR />| where class!="0"<BR />| eval m=0.75<BR />| eval p=1<BR />| eval n=class_time<BR />| eval o=m*n*p<BR />| where tot >= o<BR />| stats count as "Total"</P><P>If I run this query on Monday with the time range of last 31 hours before 2pm, some data is coming but it should be 0 as there is no school on Sunday. At 2pm on Monday, cron job is done but I dont know how to handle it before 2pm.</P><P>Pleases help.</P> Thu, 10 Dec 2020 06:25:43 GMT sweety1309 2020-12-10T06:25:43Z Manage data for Sunday https://community.splunk.com/t5/Alerting/Manage-data-for-Sunday/m-p/532589#M10046 <P>Hello,I have this query..</P><P>index="dpsn_students" earliest=0 latest=now suspended=false AND (class= "*" OR class= "* *")<BR />| dedup primaryEmail<BR />| rename primaryEmail as email<BR />| eval class=upper(class)<BR />| join type=outer email<BR />[ search index="dpsn_meet"<BR />| rex field=date "(?<yy>[^\.]*)\-(?<mm>[^\.]*)\-(?<dd>[\S]*)T(?<hh>[^\.]*)\:(?<min>[^\.]*)\:(?<sec>[^\.]*)\."<BR />| eval ndatetime = yy.mm.dd.hh.min.sec<BR />| eval _time=strptime(ndatetime,"%Y%m%d%H%M%S") + 19800<BR />| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S")<BR />| eval Duration = duration_seconds/60<BR />| stats sum(Duration) as tot by email]<BR />| join type=outer class<BR />[ search index="dpsnapitt" AND (class= "*" OR class= "* *") AND day="DAY 1" | stats count as Total by class<BR />| eval class_time=Total*30]<BR />| fillnull value="0"<BR />| where class!="0"<BR />| eval m=0.75<BR />| eval p=1<BR />| eval n=class_time<BR />| eval o=m*n*p<BR />| where tot >= o<BR />| stats count as "Total"</P><P>If I run this query on Monday with the time range of last 31 hours before 2pm, some data is coming but it should be 0 as there is no school on Sunday. At 2pm on Monday, cron job is done but I dont know how to handle it before 2pm.</P><P>Pleases help.</P> Thu, 10 Dec 2020 06:25:43 GMT https://community.splunk.com/t5/Alerting/Manage-data-for-Sunday/m-p/532589#M10046 sweety1309 2020-12-10T06:25:43Z