Getting Data In

## Compare the time for the execution

Explorer

Hello Champions,

I come across a very complex logic to tag jobs on its start time.

We have one calculated value, it can be Weekly or Daily based on Job Run start time.

Weekly= If the Job Start time is Saturday 4AM to Monday 6:PM
Daily = for remaining days in week.

If its date comparison we can easily do that. we can have cascaded if then else to check days and then time. Is there any smart way to do that ?

Thanks
Praveen

Tags (2)
Revered Legend

Assuming the field name is job_start_date and it's value is string. try like this

your base search | eval job_start_epoch=strptime(job_start_date,"%d/%m/%y %H:%M:%S") | eval dayOfWeek=lower(strftime(job_start_epoch,"%a")) | eval hour=tonumber(strftime(job_start_epoch,"%H") )
eval Type=if(dayOfWeek="sun" OR (dayOfWeek="sat" AND hour>=4) OR (dayOfWeek="mon" AND hour<=16 ),"Weekly","Daily"
Legend

Assuming this is a scheduled job that runs at different time, try add this to your search. If job start time is a field in you data, you can replace the now() with strptime of field

your base search |  eval tag=if(now()>relative_time(now(), "@w6+4h") AND now()<relative_time(now(), "@w1+6h"), "Weekly", "Daily")
Explorer

I think the answer should be

Convert the number of week and time in 24 hour. Combine them %w%H

if its more then 604(Saturday04AM) and less then 218(Monday6PM) then its weekly.
Else its daily

Revered Legend

What is the format of field job start time?

Explorer

@samesoni2

%d/%m/%y %H:%M:%s

Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!