Is there a way to exclude a specific day of the month from search results?

[SplunkLunk]

We do server updates the second Thursday of the month. So I don't want to alert on reboots when that occurs because I'll be inundated with false positives. Is there a way to exclude the second Thursday of every month from a search? Thanks in advance.

[somesoni2]

You can do like this. The relative_time in where clause compare current time (the time when the search is running) with 2nd thursday of current month and excludes matching events.

your base search | where relative_time(now(),"@d")!=relative_time(now(),"@mon+2w@w4")