Splunk Search

How do I search for business hours or non-business hours during the month?

superhm
Explorer

I would like to search for business hours(09:00 ~ 18:00) or non-business hours(18:00 ~ 09:00) during the month.
How do I set the time options?
Please help me.

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

hey try this

for business hours

index=<your_index> earliest=@mon latest=now date_hour>=9 date_hour<18

for non-business hours

index=<your_index> earliest=@mon latest=now date_hour>=18 OR date_hour<9

Also if you want to exclude Saturdays and Sundays then you should add NOT (date_wday=saturday OR date_wday=sunday) in your main search

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey try this

for business hours

index=<your_index> earliest=@mon latest=now date_hour>=9 date_hour<18

for non-business hours

index=<your_index> earliest=@mon latest=now date_hour>=18 OR date_hour<9

Also if you want to exclude Saturdays and Sundays then you should add NOT (date_wday=saturday OR date_wday=sunday) in your main search

let me know if this helps!

MarcoDV
New Member

your commands are no longer valid.
help me, the requests they made me are:
(a) bar chart for out of hours access;

(b) bar graph for access during business hours;

Tags (1)
0 Karma

superhm
Explorer

Thank you mayurr98.
Your Answer is very helpful for me.
I'll study more : )
Thanks again.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...