Splunk Search

How to write query for including non business hours and weekends

avinasa
New Member

Hi ,

I need a query for including non business hours and weekends

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @avinasa,

if you want toexclude only non working hours and weekends, you could use the solution from @smurf .

If instead you want to manage also holydays, you have to create a lookup containing all the days in a year, called e.g. cal.csv with two columns:

  • Day,
  • Type.

For the Day column choose a forma and use always the same.

For the Type column, I usually use three values:

  • 0 for working day,
  • 1 for halp working day
  • 2 for holydays.

in this way you can insert in your search the condition:

| eval Day=strftime(_time,"%d/%m/%Y") 
| lookup cal.csv Day OUTPUT Type 
| eval Hour=strftime(_time,"%H") 
| eval Minute=strftime(_time,"%M") 
| search Type=2 OR (Type=1 (Hour>14 OR (Hour<7 AND Minute<45))) OR (Type=0 (Hour>20 OR (Hour<8 AND Minute<45)))

 I prefrered also created a macro do do this.

Ciao.

Giuseppe

0 Karma

smurf
Communicator

Hi,

 

| eval date_hour = strftime(_time, "%k"), date_wday = strftime(_time, "%A") 
| search date_wday IN ("saturday", "sunday") OR (date_hour > 18 AND date_hour < 7)

 

change the times to your likings. usually the date_* fields are included, so you might not need the eval at all. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...