https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583235#M203090 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/54377">@kirrusk</a>,</P><P>what do you mean with "<SPAN>results with two days events (timestamps)." date_wday it's the same extraction than "| eval DayofWeek=strftime(_time,"%w")".</SPAN></P><P><SPAN>Anyway, yu can use your field evals and use my filter:</SPAN></P><LI-CODE lang="markup">index = _internal | eval Hour=strftime(_time,"%H") | eval Minute=strftime(_time,"%M") | eval DayofWeek=strftime(_time,"%A") | eval Month=strftime(_time,"%m") | eval WeekOfYear=strftime(_time,"%U") | search NOT DayofWeek="Wednsday" AND (Hour&gt;=10 Hour&lt;=13)</LI-CODE><P>is this the real condition you want?</P><UL><LI>exclude Wednsday and take hours between 10 and 13 (with 10 and 13)</LI></UL><P>Ciao.</P><P>Giuseppe</P> Tue, 01 Feb 2022 15:53:01 GMT gcusello 2022-02-01T15:53:01Z https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583219#M203085 <P>Hi,</P><P>&nbsp;</P><P>I'm trying to exclude events from the time range.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">index = _internal | eval Hour=strftime(_time,"%H") | eval Minute=strftime(_time,"%M") | eval DayofWeek=strftime(_time,"%w") | eval Month=strftime(_time,"%m") | eval WeekOfYear=strftime(_time,"%U") | search NOT DayofWeek=3 AND Hour&gt;10 Hour&lt;13</LI-CODE><P>&nbsp;</P><P><BR />from the above query trying to exclude Wednesday and in between 10 to 13, but it excludes all the day.<BR />Can anyone have suggestions?</P><P>Have one more scenario,</P><P>need to exclude Monday and Wednesday particular hours.</P> Tue, 01 Feb 2022 13:59:44 GMT https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583219#M203085 kirrusk 2022-02-01T13:59:44Z https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583221#M203087 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/54377">@kirrusk</a>,</P><P>at first, probably, you don't need to use eval to have hour, minute, etc..., you should have date_hour, date_minute, etc...</P><P>Anyway, to exclude <SPAN>Wednesday&nbsp;and days of the mont between 10 and 13 (comprehensive of 10 and 13), you could use something like this:</SPAN></P><LI-CODE lang="markup">index = _internal date_wday|="Wednesday " (date_mday&lt;10 AND date_mday&gt;13) | ...</LI-CODE><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Tue, 01 Feb 2022 14:15:59 GMT https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583221#M203087 gcusello 2022-02-01T14:15:59Z https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583226#M203089 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>&nbsp; date_wday not working properly, it's giving results with two days events (timestamps). So I'm using eval to take from _time</P> Tue, 01 Feb 2022 15:13:34 GMT https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583226#M203089 kirrusk 2022-02-01T15:13:34Z https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583235#M203090 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/54377">@kirrusk</a>,</P><P>what do you mean with "<SPAN>results with two days events (timestamps)." date_wday it's the same extraction than "| eval DayofWeek=strftime(_time,"%w")".</SPAN></P><P><SPAN>Anyway, yu can use your field evals and use my filter:</SPAN></P><LI-CODE lang="markup">index = _internal | eval Hour=strftime(_time,"%H") | eval Minute=strftime(_time,"%M") | eval DayofWeek=strftime(_time,"%A") | eval Month=strftime(_time,"%m") | eval WeekOfYear=strftime(_time,"%U") | search NOT DayofWeek="Wednsday" AND (Hour&gt;=10 Hour&lt;=13)</LI-CODE><P>is this the real condition you want?</P><UL><LI>exclude Wednsday and take hours between 10 and 13 (with 10 and 13)</LI></UL><P>Ciao.</P><P>Giuseppe</P> Tue, 01 Feb 2022 15:53:01 GMT https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/583235#M203090 gcusello 2022-02-01T15:53:01Z https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/584054#M203395 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/54377">@kirrusk</a>,</P><P>Hi good for you, see next time.</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 08 Feb 2022 07:53:10 GMT https://community.splunk.com/t5/Splunk-Search/exclude-time-range-in-splunk-query/m-p/584054#M203395 gcusello 2022-02-08T07:53:10Z