topic Re: earliest - latest question in Splunk Search

earliest - latest question

kstanley — Wed, 21 Jun 2017 19:38:54 GMT

I'm a newby so forgive my ignorance with Splunk. I'm running this real time and only want it to run from 6:30am to 10pm mon-sat. This is what I have on the end and it's not working. Any suggestions will be greatly appreciated.

earliest=@d+6h+30m latest=@d+22h date_wday!=sunday

Re: earliest - latest question

cmerriman — Wed, 21 Jun 2017 19:59:48 GMT

try this:

|eval keep=if((_time>=relative_time(_time,"@d+6h+30m") AND _time<=relative_time(_time,"@d+22h")) AND date_wday!="sunday",1,0)|search keep=1

Re: earliest - latest question

kstanley — Wed, 21 Jun 2017 20:05:04 GMT

Thank you, I'll give that a try

Re: earliest - latest question

somesoni2 — Wed, 21 Jun 2017 20:34:25 GMT

Are you running it as a 'real time search' and you want that search to run for specified duration? OR you're running a regular search and just want data from specified period to be included?

Re: earliest - latest question

DalJeanis — Wed, 21 Jun 2017 21:04:01 GMT

1) It's not clear whether you are saying you want to ignore data that is not in that time frame, or you want to turn the search off if the wall clock is not in that time frame?

2) Your concentration on such a wide amount of time suggests to me that a realtime search is inappropriate to what you are actually doing. So, what are you actually doing?