| makeresults count=365
| streamstats count
| eval DayOfYear=strftime(round(relative_time(now(), "-0y@y"))+((count-1)*86400),"%Y-%m-%d")
| eval FirstOfMonth=strftime(strptime(DayOfYear, "%Y-%m-%d"...
See more...
| makeresults count=365
| streamstats count
| eval DayOfYear=strftime(round(relative_time(now(), "-0y@y"))+((count-1)*86400),"%Y-%m-%d")
| eval FirstOfMonth=strftime(strptime(DayOfYear, "%Y-%m-%d"),"%Y-%m-01")
| eval Sunday=strftime(relative_time(strptime(FirstOfMonth, "%Y-%m-%d"),"+2w@w0"), "%Y-%m-%d")
| eval Match=if((Sunday=DayOfYear AND (strftime(round(relative_time(now(), "-0y@y"))+((count-1)*86400),"%m")=="03" OR strftime(round(relative_time(now(), "-0y@y"))+((count-1)*86400),"%m")=="11") ),"TRUE","FALSE")
| table _time DayOfYear FirstOfMonth Sunday Match
| search Match=TRUE This search will find the second Sunday of every March and November for the current year. You actually need to identify if today is the day before in order to trigger an alert which you can program to send an email. There might be easier methods to identify the DST change but my research has not found it yet this morning. Also this assumes the DST change is for the Americas, other portions of the globe may not share the same DST days.