Splunk Search

How to write query for including non business hours and weekends

avinasa
New Member

Hi ,

I need a query for including non business hours and weekends

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @avinasa,

if you want toexclude only non working hours and weekends, you could use the solution from @smurf .

If instead you want to manage also holydays, you have to create a lookup containing all the days in a year, called e.g. cal.csv with two columns:

  • Day,
  • Type.

For the Day column choose a forma and use always the same.

For the Type column, I usually use three values:

  • 0 for working day,
  • 1 for halp working day
  • 2 for holydays.

in this way you can insert in your search the condition:

| eval Day=strftime(_time,"%d/%m/%Y") 
| lookup cal.csv Day OUTPUT Type 
| eval Hour=strftime(_time,"%H") 
| eval Minute=strftime(_time,"%M") 
| search Type=2 OR (Type=1 (Hour>14 OR (Hour<7 AND Minute<45))) OR (Type=0 (Hour>20 OR (Hour<8 AND Minute<45)))

 I prefrered also created a macro do do this.

Ciao.

Giuseppe

0 Karma

smurf
Communicator

Hi,

 

| eval date_hour = strftime(_time, "%k"), date_wday = strftime(_time, "%A") 
| search date_wday IN ("saturday", "sunday") OR (date_hour > 18 AND date_hour < 7)

 

change the times to your likings. usually the date_* fields are included, so you might not need the eval at all. 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...