Searching for results during business hours and after-hours?

[emile194]

My customer wants a count of calls coming into their call center during their business hours (M, Tu, Th, F: 8:00 a.m. - 4:30 p.m. and W: 9:00 a.m. - 4:30 p.m.) and a count of calls that come in outside these hours and on weekends. This is what I have for the time element of the after-hours search so far, but I am getting no results:

| eval date_hour=strftime(_time, "%H") | eval date_wday = strftime(_time, "%w")
| search (date_wday=1 OR date_wday=2 OR date_wday=4 OR day_wday=5 date_hour<=7 date_hour>=17.5) OR (date_wday=3 date_hour<=8 date_hour>=17.5) OR (date_wday=6 OR date_wday=7)

[gcusello]

Hi @emile194,

there's one my ansewer to a similar question at https://community.splunk.com/t5/Splunk-Search/How-to-write-query-for-including-non-business-hours-an.... 

Your solution is correct but it doesn't manage holydays.

If you want also to manage holydays, you need to create a lookup containing all the dates of the year and a code for holyday, full working, half working.

Ciao.

Giuseppe