Extract data for weekends.

mmukherjee — Tue, 29 Sep 2020 15:33:10 GMT

Hi,
I need to calculate the amount of time for which a server was used in the weekends. For that I am using the following search string :

index="history" source = "DetailedLogs" | transaction source | convert ctime(_time) AS day_of_week timeformat="%A" | convert ctime(_time) AS day timeformat="%e" | eval weekendno = case(day>=1 AND day <=7 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 1", day>7 AND day<=14 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 2",day>14 AND day <=21 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 3",day>21 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 4") | chart count(duration) by weekendno

Firstly, after executing the search string, I am getting results of usage of the server on weekdays as well. So, clearly there's something wrong with it. Can someone point out the mistake or is there any better approach to achieve the same result?
Also, I want to count the total duration of usage, for which I should use the sum() function but it is giving me an error.
What is the default unit of the "duration" field? Is it seconds or hours?

PFA attached the screenshots. One of the event fetched has a timestamp "08-29-2017:11:41:42" which is a Tuesday.

Thanks

Re: Extract data for weekends.

gcusello — Tue, 29 Aug 2017 12:13:09 GMT

Hi
I'd use the date_wday field to filer week-end's events

index="history" source = "DetailedLogs" (date_wday=sunday OR date_wday=saturday)
| transaction source maxspan=72h
| timechart sum(duration) AS duration

Duration is expressed in seconds, if you like you can express it using eval at the end of the search

| eval duration=tostring(duration,"duration")

Bye.
Giuseppe

topic Re: Extract data for weekends. in Splunk Dev

Extract data for weekends.

Re: Extract data for weekends.