If you want to restrict the schedule of the search to only business days, then use the cron job notation for the search schedule :
example from 9am to 5pm Monday to Friday
* 9-17 * * 1-5
see cron notation http://docs.splunk.com/Documentation/Splunk/4.3.3/User/SchedulingSavedSearches#Schedule_the_alert
# Minute Hour Day of Month Month Day of Week Command
# (0-59) (0-23) (1-31) (1-12 or Jan-Dec) (0-6 or Sun-Sat)
If your goal is to search over a specific time range, then you need to use the search time range. and play with the date_* fields in the search conditions
see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers
and http://docs.splunk.com/Documentation/Splunk/4.3.3/User/UseDefaultAndInternalFields
by example to run a search over yesterday, looking only at events between 9am to 5pm :
earliest=-1d@d latest=@d date_hour>9 date_hour<17
... View more
