Splunk Search

How to write query for including non business hours and weekends

avinasa
New Member

Hi ,

I need a query for including non business hours and weekends

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @avinasa,

if you want toexclude only non working hours and weekends, you could use the solution from @smurf .

If instead you want to manage also holydays, you have to create a lookup containing all the days in a year, called e.g. cal.csv with two columns:

  • Day,
  • Type.

For the Day column choose a forma and use always the same.

For the Type column, I usually use three values:

  • 0 for working day,
  • 1 for halp working day
  • 2 for holydays.

in this way you can insert in your search the condition:

| eval Day=strftime(_time,"%d/%m/%Y") 
| lookup cal.csv Day OUTPUT Type 
| eval Hour=strftime(_time,"%H") 
| eval Minute=strftime(_time,"%M") 
| search Type=2 OR (Type=1 (Hour>14 OR (Hour<7 AND Minute<45))) OR (Type=0 (Hour>20 OR (Hour<8 AND Minute<45)))

 I prefrered also created a macro do do this.

Ciao.

Giuseppe

0 Karma

smurf
Communicator

Hi,

 

| eval date_hour = strftime(_time, "%k"), date_wday = strftime(_time, "%A") 
| search date_wday IN ("saturday", "sunday") OR (date_hour > 18 AND date_hour < 7)

 

change the times to your likings. usually the date_* fields are included, so you might not need the eval at all. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...