topic Re: How do you completely remove Saturdays and Sundays from displaying on a timechart? in Splunk Search

How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n — Fri, 22 Feb 2019 09:59:36 GMT

Hello, was looking at this topic :

https://answers.splunk.com/answers/112838/how-can-you-restrict-a-timechart-to-display-only-weekdays.html

My problem is exactly the same. I want to remove Saturdays and Sundays from my timechart. However, it does not seem to work properly in my case, it seems it just ignores them without removing them.

Example below :

Is there a way to completely remove them from the X-Axis ?

| my base search
| timechart count(foo) as "foo", count(bar) as "bar" span=1d
| eval date_wday=lower(strftime(_time,"%A")) 
| where NOT (date_wday="saturday" OR date_wday="sunday")
| fields - date_wday

Re: How do you completely remove Saturdays and Sundays from displaying on a timechart?

ashajambagi — Fri, 22 Feb 2019 12:06:29 GMT

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

Re: How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n — Fri, 22 Feb 2019 12:14:00 GMT

You sir made my day. Very nice workaround. Thank you.

Re: How do you completely remove Saturdays and Sundays from displaying on a timechart?

lakshman239 — Fri, 22 Feb 2019 12:27:43 GMT

but the above search will add last week (monday) stats to current week (monday), if you search window is more than 10 days. is that ok?

Re: How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n — Fri, 22 Feb 2019 12:45:04 GMT

Well after some testing, it seems to be ok with my search. Each Monday has different totals, and current monday has smaller totals than last week's monday, so seems good I think. Thank you for your comment still!

Re: How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n — Wed, 06 Mar 2019 09:23:09 GMT

A problem I discovered with this request, if you guys got any idea.

I created a new question :

https://answers.splunk.com/answers/730248/chart-not-displaying-in-the-right-order.html?minQuestionBodyLength=80

Re: How do you completely remove Saturdays and Sundays from displaying on a timechart?

sambit_kabi — Mon, 29 Jun 2020 07:43:17 GMT

Lifesaver. Excellent!! I still couldn't understand how is Splunk treating it differently