Hi
We have a search where we get the request time out of a webapplication. Of course those request times suffer during our weekly maintenance window. Now i tried to filter out those specific times by using the following filter:
|eval myHour=strftime(_time, "%H")
|eval myDay=strftime(_time, "%a")
|where NOT (( myHour >= 18 ) AND ( myHour <= 22 AND myDay=Thu))
The myDay on it's own doesn't work..
Somewho it's not working that way, so i appreciate any help...
Thanks
Could you not use the date_* fields for this? Those should work unless you have servers in different time zones.
sourcetype=your_web_app NOT (date_wday = thursday date_hour >=18 date_hour <= 22 )
/Kristian
Could you not use the date_* fields for this? Those should work unless you have servers in different time zones.
sourcetype=your_web_app NOT (date_wday = thursday date_hour >=18 date_hour <= 22 )
/Kristian