Splunk Search

Is there any way to sepcify the time range "holiday"?

Takajian
Builder

Is there any way to sepcify the time range "holiday"?
I know the time modifier "w0" is Sunday. But I do not know how to search event on holiday.

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee

Here's an example of a search against Splunk's internal index restricted to Christmas Eve and Christmas Day:

index=_internal (date_mday=24 OR date_mday=25) date_month=12

You could create a macro to compile all the desired holidays in to one. Keep in mind that you will need to search over a long enough period of time such that the holidays are within your time range.

Ayn
Legend

How do you define holiday? I'm assuming you don't just mean a weekend?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...