Splunk Search

Field _time modification based on _time condition ....

pioootrek
Splunk Employee
Splunk Employee

Hello,

I need to modify  _time value based on ... _time value.

 

If: 

1) original _time is before working hours, than set new _time to working hour start, like:

org _time after 00:00 before 9:00 then set new _time to 9:00

2) original_time is within working hour, leave it

3) original _time is after working hours, that modify it to next day working hour start, like

org _time is after 16:00 and before 24:00, then set new _time to 9:00 of next day

 

Anyone has an idea?

 

Regards

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval _time=case(tonumber(strftime(_time,"%H")) < 9, relative_time(_time, "@d+9h"), tonumber(strftime(_time,"%H")) > 16, relative_time(_time, "@d+16h"), 1==1, _time)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval _time=case(tonumber(strftime(_time,"%H")) < 9, relative_time(_time, "@d+9h"), tonumber(strftime(_time,"%H")) > 16, relative_time(_time, "@d+16h"), 1==1, _time)

isoutamo
SplunkTrust
SplunkTrust

Hi

Could you open what it your issue which you are trying to solve with this _time change? 

Are you trying to modify _time on search time or even in index time?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...