Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to not evaluate something during a certain time period?

$
0
0
So, I have a search query that calculates a field but I wanted to know if there is a way to check if it is a certain time period and then to not calculate that field. I have a start time and end time: for example: 10/13/2017 12:10:00 and end time 10/20/2017 14:20:00. And I wanted to change the eval so that if the current time matches that time field then to make a different calculation than what its currently calculating. Basically eval field=if("in time frame",new calculation, old calculation) Thanks

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>