Excluding public holidays from search data

[wellsajs]

Hi,

Has any one been able to work out howto incorporate the exclusion of public holidays in searches.

I am trying to work out the logic of doing such a task as I have a requirement to do this for a certain type of data set.

Any help or direction would be most appreciated

Cheers
J

[Ayn]

Public holidays are very different from country to country (and sometimes even within a country), so you'd have to create your own definition for what days are public holidays. One idea would be to enter these dates into a lookup file, then check your dates against that lookup.

[lguinn2]

A similar question: http://splunk-base.splunk.com/answers/69882/timefield-in-lookup

Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources

Blog entry:
http://blogs.splunk.com/2009/07/27/enriching-data-with-lookups-part-1/

[wellsajs]

Have you done anything like this in the past. Could you give me some pointers as to how to achieve the lookup

Thanks
J