Custom Searches - 'Out of Hours' timeframe

[iTUBS]

Hi All,

I am currently trying to perform some monitoring, and am having a bit of trouble with the Splunk search engine.

I want to return results from an entire month, but from specific times during that month

• Weekdays, after 8pm but before 8am
• Weekends, 24 hours

Does anyone know how to build this sort of query?

Thanks in advance for any help!

[Ayn]

Extract the week day and the hour from the timestamp, then check events that match your conditions. Something like this:

... | eval date_wday=strftime(_time,"%a") | eval date_hour=strftime(_time, "%H") | search (NOT (date_wday="Sat" OR date_wday="Sun") AND (date_hour>=20 OR date_hour<8)) OR date_wday="Sat" OR date_wday="Sun"

Note: the date_wday and date_hour fields are most often created automatically by Splunk, so if you're seeing that all your events already have these, you don't need to create themselves using eval like what I did above. However there are situations when they will not be created, so make sure first that you're not encountering that problem.