Getting Data In

Compare the time for the execution

praveenkpatidar
Explorer

Hello Champions,

I come across a very complex logic to tag jobs on its start time.

We have one calculated value, it can be Weekly or Daily based on Job Run start time.

Weekly= If the Job Start time is Saturday 4AM to Monday 6:PM
Daily = for remaining days in week.

If its date comparison we can easily do that. we can have cascaded if then else to check days and then time. Is there any smart way to do that ?

Thanks
Praveen

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Assuming the field name is job_start_date and it's value is string. try like this

your base search | eval job_start_epoch=strptime(job_start_date,"%d/%m/%y %H:%M:%S") | eval dayOfWeek=lower(strftime(job_start_epoch,"%a")) | eval hour=tonumber(strftime(job_start_epoch,"%H") ) 
eval Type=if(dayOfWeek="sun" OR (dayOfWeek="sat" AND hour>=4) OR (dayOfWeek="mon" AND hour<=16 ),"Weekly","Daily"
0 Karma

sundareshr
Legend

Assuming this is a scheduled job that runs at different time, try add this to your search. If job start time is a field in you data, you can replace the now() with strptime of field

your base search |  eval tag=if(now()>relative_time(now(), "@w6+4h") AND now()<relative_time(now(), "@w1+6h"), "Weekly", "Daily")
0 Karma

praveenkpatidar
Explorer

I think the answer should be

Convert the number of week and time in 24 hour. Combine them %w%H

if its more then 604(Saturday04AM) and less then 218(Monday6PM) then its weekly.
Else its daily

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is the format of field job start time?

0 Karma

praveenkpatidar
Explorer

@samesoni2

%d/%m/%y %H:%M:%s

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...