Splunk search to exclude events from field value

[iamsplunker0415]

Hello Splunk Community, 

I have a requirement to exclude the events from field values between  2AM-3AM everyday.
For Example Field USA has 4 values
USA = Texas, California, Washington, New York

I want to exclude the events from Washington between 2AM-3AM .However, I want them in remaining time 23 hours period. Is there a search to achieve this? 

[scelikok]

Hi @iamsplunker0415,

You can use "date_hour" field for filtering hours, please try below sample;

index=your_index USA="Washington" NOT date_hour IN (2,3)

[PickleRick · Accepted solution]

As usual, I advise against using the default date_* fields.

Firstly, they don't have to be present in every event so if you get the habit of relying on them you might be unpleasantly surprised. Secondly, they correspond to the original value of the original timestamp so it might not be aligned to your timezone.

I'd go with

<base search>
| eval hour=strftime(_time,"%H")
| where NOT (hour>=2 AND hour<=3 AND in(USA,"Washington","New York",and so on))

[iamsplunker0415]

@scelikok Thank you. 

index=<myindex>
|search USA="Washington" NOT date_hour IN (2,3)
is not working it's only filtering washington not excluding events between 2-3
I also want the remanining values reported all the time.