Getting Data In

How to exclude specific time ranges in search results

Builder

I have a datasource which contains availability statistics from an application. I also have a predetermined maintenance schedule that occurs every two weeks on the same day and time. How can I use search to exclude the date/time ranges for my maintenance schedule in my search results?

Tags (1)
1 Solution

Revered Legend

If do something like this

index=yourIndex| eval MaintEnd=strptime("2014/03/26 11:00:00 AM","%Y/%m/%d %H:%M:%S %p") | eval MaintStart=strptime("2014/03/26 10:50:00 AM","%Y/%m/%d %H:%M:%S %p") | where _time > MaintEnd OR _time < MaintStart

View solution in original post

Explorer

If you're trying to detect a 0-event period excluding some outage window timeframe, here's a generic search you could use:

index=my_index sourcetype=my_sourcetype  my_filter_criteria_here
| timechart span=1m count 
| search count=0 
| where NOT (date_wday=="sunday" AND date_hour >= 0 AND date_hour < 4)

I'm doing the where clause after detecting 0-event minutes because if you initially filter by those windows, you'll see no events there. Obviously if you are looking for a certain event rather than monitoring for a void in events you can do that filter right in the first line of the search.
You'd have to add more to your where clause to specify bi-weekly windows.

0 Karma

Revered Legend

If do something like this

index=yourIndex| eval MaintEnd=strptime("2014/03/26 11:00:00 AM","%Y/%m/%d %H:%M:%S %p") | eval MaintStart=strptime("2014/03/26 10:50:00 AM","%Y/%m/%d %H:%M:%S %p") | where _time > MaintEnd OR _time < MaintStart

View solution in original post

SplunkTrust
SplunkTrust

If the maintenance window were every wednesday between 3am and 5am you could do this:

index=yourIndex NOT (date_wday=wednesday date_hour>=3 date_hour<5)

Then Splunk would not even load those events off disk - great if a lot of volume happens during maintenance.
However, I don't think there's a straightforward way of specifying "every other wednesday".

Builder

That gets me closer. Now how can I specify a relative day, like every friday?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!