earliest - latest question

[kstanley]

I'm a newby so forgive my ignorance with Splunk. I'm running this real time and only want it to run from 6:30am to 10pm mon-sat. This is what I have on the end and it's not working. Any suggestions will be greatly appreciated.

earliest=@d+6h+30m latest=@d+22h date_wday!=sunday

[DalJeanis]

1) It's not clear whether you are saying you want to ignore data that is not in that time frame, or you want to turn the search off if the wall clock is not in that time frame?

2) Your concentration on such a wide amount of time suggests to me that a realtime search is inappropriate to what you are actually doing. So, what are you actually doing?

[somesoni2]

Are you running it as a 'real time search' and you want that search to run for specified duration? OR you're running a regular search and just want data from specified period to be included?

[cmerriman]

try this:

|eval keep=if((_time>=relative_time(_time,"@d+6h+30m") AND _time<=relative_time(_time,"@d+22h")) AND date_wday!="sunday",1,0)|search keep=1

[kstanley]

Thank you, I'll give that a try