Splunk Enterprise Security

Eval value depending on hour of day

jacqu3sy
Path Finder

Is there a way to return a specific value if an event is seen between 18:00 and 07:00 the following day?

I need to generate a different value if something occurs overnight.

Was originally thinking of an eval with a > than, but then 02:00 would be less than 11pm so I'm confused as to whether it's possible!

Thanks.

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @ jacqu3sy,
eval command is your solution:

your_search
| eval check=if(date_hour>17 OR date_hour<8,"1","2")
| ...

Ciao and merry Christmas.
Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @ jacqu3sy,
eval command is your solution:

your_search
| eval check=if(date_hour>17 OR date_hour<8,"1","2")
| ...

Ciao and merry Christmas.
Giuseppe

0 Karma

jacqu3sy
Path Finder

Perfect. Many thanks. Have a great Xmas.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...