take two same days in a week only if the difference between the start day and end day is not more than 24 hours

[avi123]

Hi All, how to write a query in Splunk to take two same days in a week only if the difference between the start day and end day is not more than 24 hours. For example - the two days can be Tuesday, but the query should check the difference between two Tuesdays is less than 24 hours, which means the end day hours and the starting day hours falls in the same Tuesday.

[ITWhisperer]

You could do something like this

| eval sameday=if(relative_time(starttime,"@d")=relative_time(endtime,"@d"),"true","false")