Reporting

SPL query exclusion/inclusion

auzark
Path Finder

Will someone please confirm the exclusion/inclusion that occurs based on the below statement.

The way I interpret the below statement is 
*No events that occur on Monday or Thursday that occur before 07:00 
*No events that occur on Monday or Thursday that occur after 09:00 
*All events for other days of the week regardless of time
*Exclude any events from the 1st day of the month regardless of day of the week or time

|eval date_wday=strftime(epochtime,"%w")| eval day_sat=strftime(_time,"%A")|eval time=strftime(_time,"%H:%M") | eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d")
| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @auzark

| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

Your query will return only events that time < "07:00" OR time > "09:00" regardless of the day. Since NOT covers only the first comparison, it will try to filter Monday and Thursday but the OR statements coming after that will not allow that. I changed time format to keep only hour to make time comparison safer. Also day_number is not a default field, that is why I calculated as MonthDay variable.

I hope I could explained well.

Merry Christmas!

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @auzark, below query should work;

| eval date_wday=strftime(epochtime,"%w") 
| eval day_sat=strftime(_time,"%A") 
| eval time=strftime(_time,"%H") 
| eval MonthDay=strftime(_time,"%d")
| eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d") 
| where NOT ((day_sat="Monday" OR day_sat="Thursday") AND (time < "07" OR time > "09")) AND MonthDay!="01"

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

auzark
Path Finder

Hi @scelikok,

I appreciate your reply and I'll give that a try.

Could you tell me what you think the query I posted does?

btw... Merry Christmas!

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @auzark

| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

Your query will return only events that time < "07:00" OR time > "09:00" regardless of the day. Since NOT covers only the first comparison, it will try to filter Monday and Thursday but the OR statements coming after that will not allow that. I changed time format to keep only hour to make time comparison safer. Also day_number is not a default field, that is why I calculated as MonthDay variable.

I hope I could explained well.

Merry Christmas!

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

auzark
Path Finder

Hi @scelikok,

 

Thanks, Perfectly clear explanation.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...