Trick to manage business hours / weekdays at search time

[splunkreal]

Hello guys,

this isn't a question just a trick 🙂

Add this to your query :

| appendcols 
    [| makeresults 
    |  eval curWDay=strftime(_time,"%A")
|  eval curHour=tonumber(strftime(_time,"%H"))]
| search ((curHour>08 AND curHour<13) OR (curHour>13 AND curHour<20))
| search (curWDay = Monday OR curWDay = Tuesday OR curWDay = Wednesday OR curWDay = Thursday OR curWDay = Friday)