Splunk Search

Searching for results during business hours and after-hours?

emile194
New Member

My customer wants a count of calls coming into their call center during their business hours (M, Tu, Th, F: 8:00 a.m. - 4:30 p.m. and W: 9:00 a.m. - 4:30 p.m.) and a count of calls that come in outside these hours and on weekends. This is what I have for the time element of the after-hours search so far, but I am getting no results:

| eval date_hour=strftime(_time, "%H") | eval date_wday = strftime(_time, "%w")
| search (date_wday=1 OR date_wday=2 OR date_wday=4 OR day_wday=5 date_hour<=7 date_hour>=17.5) OR (date_wday=3 date_hour<=8 date_hour>=17.5) OR (date_wday=6 OR date_wday=7)
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @emile194,

there's one my ansewer to a similar question at https://community.splunk.com/t5/Splunk-Search/How-to-write-query-for-including-non-business-hours-an...

Your solution is correct but it doesn't manage holydays.

If you want also to manage holydays, you need to create a lookup containing all the dates of the year and a code for holyday, full working, half working.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...