Date validate to check before 8AM daily

[splunk_hvijay]

Hi, Need your help on the below.

I want to validate a date/time to check if that time is before or after 8AM daily. For example, i want to validate the Timestamp column to check if its before/after 8AM on that day and need a new column "Result" like below

Timestamp Result
10/13/2016 03:45:00AM Before 8AM
10/16/2016 7:59:00AM Before 8AM
10/23/2016 12:30:00PM After 8AM
10/21/2016 13:45:00PM After 8AM

Please help me on how to achieve this... Thanks in advance for you help.

[sundareshr]

Try this

base search | eval ts=strftime(strptime(Timestamp, "%m/%d/%Y %-I:%M:%S%p"), "%H") | eval Result=if(ts<08, "Before 8AM", "After 8AM") | table Timestamp ts Result