Splunk Enterprise Security

Eval value depending on hour of day

Path Finder

Is there a way to return a specific value if an event is seen between 18:00 and 07:00 the following day?

I need to generate a different value if something occurs overnight.

Was originally thinking of an eval with a > than, but then 02:00 would be less than 11pm so I'm confused as to whether it's possible!

Thanks.

0 Karma
1 Solution

Legend

Hi @ jacqu3sy,
eval command is your solution:

your_search
| eval check=if(date_hour>17 OR date_hour<8,"1","2")
| ...

Ciao and merry Christmas.
Giuseppe

View solution in original post

0 Karma

Legend

Hi @ jacqu3sy,
eval command is your solution:

your_search
| eval check=if(date_hour>17 OR date_hour<8,"1","2")
| ...

Ciao and merry Christmas.
Giuseppe

View solution in original post

0 Karma

Path Finder

Perfect. Many thanks. Have a great Xmas.

0 Karma