Splunk Search

How do I search for business hours or non-business hours during the month?

superhm
Explorer

I would like to search for business hours(09:00 ~ 18:00) or non-business hours(18:00 ~ 09:00) during the month.
How do I set the time options?
Please help me.

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

hey try this

for business hours

index=<your_index> earliest=@mon latest=now date_hour>=9 date_hour<18

for non-business hours

index=<your_index> earliest=@mon latest=now date_hour>=18 OR date_hour<9

Also if you want to exclude Saturdays and Sundays then you should add NOT (date_wday=saturday OR date_wday=sunday) in your main search

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey try this

for business hours

index=<your_index> earliest=@mon latest=now date_hour>=9 date_hour<18

for non-business hours

index=<your_index> earliest=@mon latest=now date_hour>=18 OR date_hour<9

Also if you want to exclude Saturdays and Sundays then you should add NOT (date_wday=saturday OR date_wday=sunday) in your main search

let me know if this helps!

MarcoDV
New Member

your commands are no longer valid.
help me, the requests they made me are:
(a) bar chart for out of hours access;

(b) bar graph for access during business hours;

Tags (1)
0 Karma

superhm
Explorer

Thank you mayurr98.
Your Answer is very helpful for me.
I'll study more : )
Thanks again.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...