Getting Data In

## Compare the time for the execution

Explorer

Hello Champions,

I come across a very complex logic to tag jobs on its start time.

We have one calculated value, it can be Weekly or Daily based on Job Run start time.

Weekly= If the Job Start time is Saturday 4AM to Monday 6:PM
Daily = for remaining days in week.

If its date comparison we can easily do that. we can have cascaded if then else to check days and then time. Is there any smart way to do that ?

Thanks
Praveen

Tags (2)
Revered Legend

Assuming the field name is job_start_date and it's value is string. try like this

``````your base search | eval job_start_epoch=strptime(job_start_date,"%d/%m/%y %H:%M:%S") | eval dayOfWeek=lower(strftime(job_start_epoch,"%a")) | eval hour=tonumber(strftime(job_start_epoch,"%H") )
eval Type=if(dayOfWeek="sun" OR (dayOfWeek="sat" AND hour>=4) OR (dayOfWeek="mon" AND hour<=16 ),"Weekly","Daily"
``````
Legend

Assuming this is a scheduled job that runs at different time, try add this to your search. If job start time is a field in you data, you can replace the `now()` with `strptime` of field

``````your base search |  eval tag=if(now()>relative_time(now(), "@w6+4h") AND now()<relative_time(now(), "@w1+6h"), "Weekly", "Daily")
``````
Explorer

I think the answer should be

Convert the number of week and time in 24 hour. Combine them %w%H

if its more then 604(Saturday04AM) and less then 218(Monday6PM) then its weekly.
Else its daily

Revered Legend

What is the format of field job start time?

Explorer

@samesoni2

%d/%m/%y %H:%M:%s

The Latest From the Splunk Community!