<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: To exclude non-business hours &amp;amp;amp; weekends in mstats in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697510#M57171</link>
    <description>&lt;P&gt;Modified Query&lt;/P&gt;
&lt;P&gt;============&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour&amp;gt;=6 AND hour&amp;lt;=18 AND dow!=0 AND dow!=6 | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response1&lt;/LI-CODE&gt;</description>
    <pubDate>Tue, 27 Aug 2024 19:00:19 GMT</pubDate>
    <dc:creator>sabari80</dc:creator>
    <dc:date>2024-08-27T19:00:19Z</dc:date>
    <item>
      <title>To exclude non-business hours &amp;amp; weekends in mstats</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697506#M57169</link>
      <description>&lt;P&gt;i am trying to exclude non-business hours &amp;amp; weekends in my mstats query. Original Query: | mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response Modified this query like below and not getting any results | mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour&amp;gt;=6 AND hour&amp;lt;=18 AND dow!=0 AND dow!=6 | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response1 can anyone please help me to achieve this? Thanks in advance.&lt;/P&gt;</description>
      <pubDate>Tue, 27 Aug 2024 18:26:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697506#M57169</guid>
      <dc:creator>sabari80</dc:creator>
      <dc:date>2024-08-27T18:26:08Z</dc:date>
    </item>
    <item>
      <title>Re: To exclude non-business hours &amp;amp; weekends in mstats</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697509#M57170</link>
      <description>&lt;P&gt;Original Query&lt;/P&gt;
&lt;P&gt;============&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response &lt;/LI-CODE&gt;</description>
      <pubDate>Tue, 27 Aug 2024 18:59:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697509#M57170</guid>
      <dc:creator>sabari80</dc:creator>
      <dc:date>2024-08-27T18:59:53Z</dc:date>
    </item>
    <item>
      <title>Re: To exclude non-business hours &amp;amp; weekends in mstats</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697510#M57171</link>
      <description>&lt;P&gt;Modified Query&lt;/P&gt;
&lt;P&gt;============&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour&amp;gt;=6 AND hour&amp;lt;=18 AND dow!=0 AND dow!=6 | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response1&lt;/LI-CODE&gt;</description>
      <pubDate>Tue, 27 Aug 2024 19:00:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697510#M57171</guid>
      <dc:creator>sabari80</dc:creator>
      <dc:date>2024-08-27T19:00:19Z</dc:date>
    </item>
    <item>
      <title>Re: To exclude non-business hours &amp;amp; weekends in mstats</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697550#M57180</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250947"&gt;@sabari80&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;what's your issue?&lt;/P&gt;&lt;P&gt;anyway, I created a macro (called e.g. "non_working_hours") and I call it, in this way if I need to modify one hour I have to do this in only one search.&lt;/P&gt;&lt;P&gt;In addition, I created a lookup containing all the days of the next three years with the indication of holydays, in this way, in my macro, I can check also holydays, in addition to off office hours and weekends.&lt;/P&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 28 Aug 2024 06:37:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697550#M57180</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2024-08-28T06:37:17Z</dc:date>
    </item>
    <item>
      <title>Re: To exclude non-business hours &amp;amp; weekends in mstats</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697597#M57186</link>
      <description>&lt;P class="lia-align-left"&gt;i wanted to omit data for non-business hours and weekends. i have tried this below query and not getting any results - added this portion --&amp;gt;&amp;nbsp;&lt;/P&gt;&lt;PRE&gt;eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour&amp;gt;=6 AND hour&amp;lt;=18 AND dow!=0 AND dow!=6&lt;/PRE&gt;&lt;P&gt;| mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour&amp;gt;=6 AND hour&amp;lt;=18 AND dow!=0 AND dow!=6 | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response1&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 28 Aug 2024 14:09:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/To-exclude-non-business-hours-amp-amp-weekends-in-mstats/m-p/697597#M57186</guid>
      <dc:creator>sabari80</dc:creator>
      <dc:date>2024-08-28T14:09:27Z</dc:date>
    </item>
  </channel>
</rss>

