How to not evaluate something during a certain time period?

[kdimaria]

So, I have a search query that calculates a field but I wanted to know if there is a way to check if it is a certain time period and then to not calculate that field. I have a start time and end time: for example: 10/13/2017 12:10:00 and end time 10/20/2017 14:20:00. And I wanted to change the eval so that if the current time matches that time field then to make a different calculation than what its currently calculating. Basically eval field=if("in time frame",new calculation, old calculation)

Thanks

[gcusello · Accepted solution]

Hi kdimaria,
you could try something like this (if my_time is the field name in your logs but not _time):

| eval field=if(my_time>earliest AND my_time<latest,new calculation, old calculation)

Bye.
Giuseppe