Hi @essibong1,
sorry, probably I wasn't so clear in my previous answer!
this is a macro definition that I hinted in my answer to your previous question ( https://answers.splunk.com/answers/789359/can-any-one-provide-me-with-a-good-search-to-monit.html#an... 😞 I used a macro to have in only one point the working time definition so I can modify it in only one point instead in each search of my app.
Anyway, if you don't want to use a macro, you have to create your search starting from the filter for the access events (e.g. in windows EventCode=4624) and then filter for the hours and minutes.
The other needed information is if you want only to filter for time or you want also to filter for holydays:
if you want to filter only for time, you can run something like this (working time 8.00 - 17.00):
index=your_index EventCode=4624 (date_hour<8 OR date_hour>18)
| ...
If instead you want also holydays (using the lookup), you have to create a lookup (called e.g. SIEMCAL.csv) containing two information:
- day in a format you like (e.g. dd/mm/yyyy),
- type (0 for working time, 1 for half working time, 2 for holydays).
So for windows systems you can run something like this:
index=your_index EventCode=4624
| eval day=strftime(_time,"%d/%m/%Y")
| lookup SIEMCAL.csv day OUTPUT type
| search type=2 OR (Tipo=1 (date_hour>14 OR (date_hour<8)) OR (type=0 (date_hour>18 OR date_hour<8)))
| ...
Ciao.
Giuseppe
