Splunk Search

Accounting for weekends and holidays

AlexeyPy
Engager

I'm trying to come up with a method of accounting for weekends and holidays. Tell me, how should I implement this algorithm?
Real case: we need to catch response on the application after 2 working days subject to weekends and holidays.

There is the idea to implement it with a lookup, however, will have to manually affix the holidays every year. I would like to automate this process completely.

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi AlexeyPy,
for week-ends you can add to your searches

date_wday="sunday" OR date_wday="saturday"

instead to manage holydays the only way is to create a lookup containing holyday dates and use it to filter your searches.

your_search (date_wday="sunday" OR date_wday="saturday" OR [ | inputlookup holydays.csv | fields date ] )

putting attention on the date format that must be the same for _time and your lookup.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...