Splunk Search

help for retrieving events during the week only

jip31
Motivator

hi

I use this search in order to retrieve events between 9h and 17h

Now I also want to catch the events only between the monday and the friday

How to do this please?

 

 

 

`CPU` 
| bin _time span=5h
| eval slottime = strftime(_time, "%H%M") 
| where (slottime >= 900 AND slottime <= 1700) 

 

 

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The w needs to be lower case

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

strftime with %w then where value between 1 and 5 inclusive

0 Karma

jip31
Motivator

like this??

 

`CPU` 
| bin _time span=5h 
| eval slottime = strftime(_time, "%H%M") 
| eval week =strftime(_time, "%W") 
| where (slottime >= 900 AND slottime <= 1700) AND (week >=1 AND week <=5)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The w needs to be lower case

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...