Splunk Search

count time between each period time

wcastillocruz
Path Finder

Hello dear community,
I have a splunk search where I look for all the events that occur over a specific period of time. this period is "from Monday at 5 am until Friday 10 pm" I wish to be able to calculate the time that there is between this period independently of whether or not there are events in the period (it will depend on my choice in the "select time" button). if in my select time I chose the last month and the month is made up of 5 weeks I must calculate the time over all my periods "from Monday at 5 am until Friday 10 pm"

i have this :
...| eval date_wday = strftime(_time, "%w%H") | search date_wday>=106 AND date_wday<=523

Could you help me on this

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...