How to exclude logs with specific time ranges from a search?

[karlduncans]

Hello,

I'd like to exclude a specific time range from appearing in a search.

I have a custom time stamp field in these particular logs. example: timestamp='2014-06-22 T 01:48:12.6942440'

index=myindex sourcetype="my_source" TimeStampField!=?? | top 20 Errors

I'd want to exclude all logs with a timestamp of say, 2am to 6am every day, and if possible exclude different time ranges depending on the day.

For example, exclude all logs from 2am to 6am on weekdays, and exclude all logs on weekends from sat 10pm to sunday 6am.

Thank you!

[somesoni2]

You can try something like this

index=myindex sourcetype="my_source" | eval shouldInclude=case((date_wday="monday" OR date_wday="tuesday" OR date_wday="wednesday" OR date_wday="thursday" OR date_wday="friday") AND (date_hour >=2 AND date_hour<=6),0,date_wday="saturday" AND date_hour >=10 ,0,date_wday="sunday" AND date_hour<=6,0,1=1,1) | where shouldInclude=1 | top 20 Errors