Can I tag time as scheduled maintenance to exclude events from searches?

[jkeglovitz]

I would like to tag various time periods as "scheduled maintenance," so that my application error searches ignore events during these periods. The maintenance periods are irregular and of different durations. If I could transform these periods into custom fields, that would be ideal, I think. Then I could do something like

search "error" scheduled_maintenance=0
| stats etc

Does anyone have a suggestion on how I could achieve this goal?

[dwaddle · Accepted solution]

I don't know of such support directly. I think I would probably approach it using a dynamic lookup. Your dynamic lookup script could, based on combinations of _time and host, output a field for scheduled_maintenance which you'd then filter on.

A good place to start might be

http://docs.splunk.com/Documentation/Splunk/4.2.3/Knowledge/Addfieldsfromexternaldatasources#Set_up_...