Splunk Enterprise Security

Is there a way to have a duration value account for weekends

Funderburg78
Path Finder

So in python coding you can use rrule to assign weekends in weeks and subtract them from your calculation.  I ask because I am getting a Ticket open dat, and a ticket close date and I am attempting to determine SLA values based on working days (i.e.; we are not open weekends and are only open 6am-6pm) for tickets that span nights or weekends, how can i remove those time values dynamically for data that is being automatically pulled from a ticket system and not using a static value like an excel spreadsheet.  i.e.; This needs to be able to continue updating as time goes....  Bonus points if you can help account for a 6am - 6pm workday for SLA timers... Bonus bonus if you know how to exclude holidays, LOL

Labels (1)
0 Karma

Funderburg78
Path Finder

I will try adapting this tomorrow and let you know if I have any issues 😛  Thanks so much for the reply.  If it works I will mark it as a solution as well.  In the meantime, Karma for the starting point 😛

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I answered a similar question about a month ago.

https://community.splunk.com/t5/Splunk-Search/count-time-of-my-select-time-within-week-ends/m-p/5531...

The principle could be adapted to take account of time left in the day at the beginning and time used in the day at the end and multiplying the number of intervening work days by 12 hours and adding on the previously calculated partial days.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...