topic Re: How to skip the weekends in the timechart or a chart? in Dashboards & Visualizations

How to skip the weekends in the timechart or a chart?

sambit_kabi — Mon, 29 Jun 2020 07:05:25 GMT

I have a search query which yields a timechart . I want to show just the weekdays and skip the weekends in the charting of data using timechart.

I have used the clause | eval day_of_week = strftime(_time,"%A")
| where NOT (day_of_week="Saturday" OR day_of_week="Sunday")
| fields - day_of_week in my query before and after the timechart.

The data doesn't have the weekend information whereas when this is charted using the timechart I always get the weekends on my x-axis.

Any idea how to solve it?

Re: How to skip the weekends in the timechart or a chart?

cpm003 — Mon, 29 Jun 2020 08:59:41 GMT

Hello!

Try in this order

[...]

| where NOT date_wday in ("Saturday","Sunday")
| eval day_of_week = strftime(_time,"%A")

[...]

Re: How to skip the weekends in the timechart or a chart?

sambit_kabi — Tue, 30 Jun 2020 08:48:07 GMT

Hi , thanks for the reply. I had tried the same with the clause before and after the chart command. It didn't work for me in either case.

However the following worked for me. I am not not sure though why it worked and what is Splunk's behavior when I used strftime.

| eval date=strftime(_time,"%d-%b-%y %H:%M:%S %a")
| chart limit=0 useother=false count as Volume by date,Description

Re: How to skip the weekends in the timechart or a chart?

to4kawa — Tue, 30 Jun 2020 10:56:44 GMT

sample:

| tstats count where index=_internal earliest=0 by _time span=1d | eval weekday=if(strftime(_time,"%w") = "0" OR strftime(_time,"%w") = "6",1,0) | where weekday=0 | eval weekday=strftime(_time,"%a")

reference:https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables