https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481362#M134895 <P>I have a customer that needs to have a dashboard showing a start date of Saturday and ending on the current workday. The search that I have tried, with no results, is: </P> <PRE><CODE>index=| eval today=strftime(now(),"%a") | eval Backdays=case(today=="Mon",2,today=="Tue",3,today=="Wed",4,today=="Thur",5,today=="Fri",6) | search earliest=-"Backdays"d@d latest=now </CODE></PRE> <P>There is definitely data for this past Saturday, Sunday and today (Monday) and the "Backdays" field is populating with a 1 (in this case)</P> <P>Any help is most appreciated.</P> <P>Thank you.</P> Mon, 02 Mar 2020 20:13:20 GMT SteveBowser 2020-03-02T20:13:20Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481362#M134895 <P>I have a customer that needs to have a dashboard showing a start date of Saturday and ending on the current workday. The search that I have tried, with no results, is: </P> <PRE><CODE>index=| eval today=strftime(now(),"%a") | eval Backdays=case(today=="Mon",2,today=="Tue",3,today=="Wed",4,today=="Thur",5,today=="Fri",6) | search earliest=-"Backdays"d@d latest=now </CODE></PRE> <P>There is definitely data for this past Saturday, Sunday and today (Monday) and the "Backdays" field is populating with a 1 (in this case)</P> <P>Any help is most appreciated.</P> <P>Thank you.</P> Mon, 02 Mar 2020 20:13:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481362#M134895 SteveBowser 2020-03-02T20:13:20Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481363#M134896 <P>I'll answer my own question - <BR /> earliest=@w6 latest=now</P> <P>No need for the evals.</P> <P>Have a great day!</P> Mon, 02 Mar 2020 20:54:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481363#M134896 SteveBowser 2020-03-02T20:54:47Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481364#M134897 <P>Splunk can do that for you. Use <CODE>earliest_time</CODE> to say you want the beginning of the current week minus one day.</P> <PRE><CODE>index=foo earliest_time=@w-1d </CODE></PRE> Mon, 02 Mar 2020 21:01:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481364#M134897 richgalloway 2020-03-02T21:01:54Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481365#M134898 <P>Yes, I like your answer better than mine. Thank you for the quick response</P> Mon, 02 Mar 2020 21:16:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-showing-data-starting-on-a-Saturday-up-to/m-p/481365#M134898 SteveBowser 2020-03-02T21:16:44Z