Splunk Search

Exclude a specific date/time of data from an overall average

Explorer

I am calculating monthly averages and have an issue where on a single day in October there was an error in the data. I would like to remove this single date and time range (Oct 12th 00:00-04:00) from the overall monthly average but don't want to impact future month calculations.

I run the following command for year to date to get monthly average -
index=xyz sourcetype=zyx | timechart span=1month avg(VALUE)

When I add NOT earliest="10/12/2019:00:00:00" latest="10/12/2019:04:00:00" to my base search it only provides that date. I tried adding brackets etc and it is not working.

Any suggestions would be appreciated!
Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You could try where with timestamp boundaries. For example, this excludes 10/31/2019 09:00 - 10:00:

... | where _time<1572537600 OR _time>1572541200

View solution in original post

SplunkTrust
SplunkTrust

You could try where with timestamp boundaries. For example, this excludes 10/31/2019 09:00 - 10:00:

... | where _time<1572537600 OR _time>1572541200

View solution in original post

Explorer

That works, thank you !!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!