Reporting

SPL query exclusion/inclusion

auzark
Path Finder

Will someone please confirm the exclusion/inclusion that occurs based on the below statement.

The way I interpret the below statement is 
*No events that occur on Monday or Thursday that occur before 07:00 
*No events that occur on Monday or Thursday that occur after 09:00 
*All events for other days of the week regardless of time
*Exclude any events from the 1st day of the month regardless of day of the week or time

|eval date_wday=strftime(epochtime,"%w")| eval day_sat=strftime(_time,"%A")|eval time=strftime(_time,"%H:%M") | eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d")
| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @auzark

| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

Your query will return only events that time < "07:00" OR time > "09:00" regardless of the day. Since NOT covers only the first comparison, it will try to filter Monday and Thursday but the OR statements coming after that will not allow that. I changed time format to keep only hour to make time comparison safer. Also day_number is not a default field, that is why I calculated as MonthDay variable.

I hope I could explained well.

Merry Christmas!

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @auzark, below query should work;

| eval date_wday=strftime(epochtime,"%w") 
| eval day_sat=strftime(_time,"%A") 
| eval time=strftime(_time,"%H") 
| eval MonthDay=strftime(_time,"%d")
| eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d") 
| where NOT ((day_sat="Monday" OR day_sat="Thursday") AND (time < "07" OR time > "09")) AND MonthDay!="01"

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

auzark
Path Finder

Hi @scelikok,

I appreciate your reply and I'll give that a try.

Could you tell me what you think the query I posted does?

btw... Merry Christmas!

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @auzark

| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

Your query will return only events that time < "07:00" OR time > "09:00" regardless of the day. Since NOT covers only the first comparison, it will try to filter Monday and Thursday but the OR statements coming after that will not allow that. I changed time format to keep only hour to make time comparison safer. Also day_number is not a default field, that is why I calculated as MonthDay variable.

I hope I could explained well.

Merry Christmas!

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

auzark
Path Finder

Hi @scelikok,

 

Thanks, Perfectly clear explanation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...