Splunk Search

Exclude a specific date/time of data from an overall average

DanielleM
Explorer

I am calculating monthly averages and have an issue where on a single day in October there was an error in the data. I would like to remove this single date and time range (Oct 12th 00:00-04:00) from the overall monthly average but don't want to impact future month calculations.

I run the following command for year to date to get monthly average -
index=xyz sourcetype=zyx | timechart span=1month avg(VALUE)

When I add NOT earliest="10/12/2019:00:00:00" latest="10/12/2019:04:00:00" to my base search it only provides that date. I tried adding brackets etc and it is not working.

Any suggestions would be appreciated!
Thanks!

0 Karma
1 Solution

nplamondon
SplunkTrust
SplunkTrust

You could try where with timestamp boundaries. For example, this excludes 10/31/2019 09:00 - 10:00:

... | where _time<1572537600 OR _time>1572541200

View solution in original post

nplamondon
SplunkTrust
SplunkTrust

You could try where with timestamp boundaries. For example, this excludes 10/31/2019 09:00 - 10:00:

... | where _time<1572537600 OR _time>1572541200

DanielleM
Explorer

That works, thank you !!!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...