Hi
I have a SPL query that needs to adjust at search time when we are falling in and out of BST. During BST, the search has to search between the hours of 19:00 & 7:00. Outside of BST, the search needs to adjust and search between the hours of 20:00 & 8:00.
I have created a lookup where I capture the dates of when BST starts and stops. I have also created the logic max date and min date to identify the Sundays that start and end BST. This part is working
I need help to complete the search to filter results where if the date is outside of BST, to adjust from 19:00-7:00 search window to the 20:00 - 8:00 search window.
index=my_index
| eval year=strftime(_time,"%Y")
| lookup bst_lookup.csv year OUTPUTNEW date_sunday
| stats values(*) as * max(date_sunday) as maxdate min(date_sunday) as mindate latest(_time) as time by field
| eval isbst=if(time>mindate AND time<maxdate , 1,0)
Thanks!
... View more