Splunk Enterprise Security

Eval value depending on hour of day

jacqu3sy
Path Finder

Is there a way to return a specific value if an event is seen between 18:00 and 07:00 the following day?

I need to generate a different value if something occurs overnight.

Was originally thinking of an eval with a > than, but then 02:00 would be less than 11pm so I'm confused as to whether it's possible!

Thanks.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ jacqu3sy,
eval command is your solution:

your_search
| eval check=if(date_hour>17 OR date_hour<8,"1","2")
| ...

Ciao and merry Christmas.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ jacqu3sy,
eval command is your solution:

your_search
| eval check=if(date_hour>17 OR date_hour<8,"1","2")
| ...

Ciao and merry Christmas.
Giuseppe

0 Karma

jacqu3sy
Path Finder

Perfect. Many thanks. Have a great Xmas.

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...