Hi All,
I am currently trying to perform some monitoring, and am having a bit of trouble with the Splunk search engine.
I want to return results from an entire month, but from specific times during that month
Does anyone know how to build this sort of query?
Thanks in advance for any help!
Extract the week day and the hour from the timestamp, then check events that match your conditions. Something like this:
... | eval date_wday=strftime(_time,"%a") | eval date_hour=strftime(_time, "%H") | search (NOT (date_wday="Sat" OR date_wday="Sun") AND (date_hour>=20 OR date_hour<8)) OR date_wday="Sat" OR date_wday="Sun"
Note: the date_wday
and date_hour
fields are most often created automatically by Splunk, so if you're seeing that all your events already have these, you don't need to create themselves using eval
like what I did above. However there are situations when they will not be created, so make sure first that you're not encountering that problem.