Splunk Search

How to calculate elapsed time only on working hours ?

clementros
Path Finder

Hi all, 

I'm trying to calculate the time support team took to respond when a new ticket is created. 

For now i'm able to calculate the duration between a status new and other next status of the ticket with the command transaction : 

| transaction "Record Number" startswith="New" endswith=eval(NOT match(_raw,"New"))
| table "Record Number", "PI Event Time", duration

 

Next step is to calculate this duration only on working hours. For that i need to substract duration value with weekend or holidays duration if there are between the start and end date ? 

For holidays i know i should create a lookup table with holidays with the same date format. But i do not know how to do the substraction time only if no working date are between start and end duration

Can you help me please ?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...