https://community.splunk.com/t5/Splunk-Search/Search-that-combines-last-7-days-and-year-to-date/m-p/543130#M153854 <P>Previous business week you can get with "snap to" on the relative_time command, so this will calculate the start and end range of week starting on Monday and ending Sunday</P><LI-CODE lang="markup">| eval start_week=relative_time(now(), "-w@w1"), end_week=start_week+(86400 * 7)</LI-CODE><P>&nbsp;Note that your use of&nbsp;</P><P><SPAN>| where _time&gt;strptime("2021/02/01 00:00:00","%Y/%m/%d %H:%M:%S")</SPAN></P><P><SPAN>seems unnecessary, as you can either set that date range from your search time window or just as </SPAN></P><LI-CODE lang="markup">earliest="02/01/2021 00:00:00"</LI-CODE><P>on the search line.</P><P>&nbsp;</P> Wed, 10 Mar 2021 04:10:24 GMT bowesmana 2021-03-10T04:10:24Z https://community.splunk.com/t5/Splunk-Search/Search-that-combines-last-7-days-and-year-to-date/m-p/543120#M153851 <P>My current search below pulls findings for current day and year-to-date starting 2/1/2021.&nbsp; I need help with a way to pull for the previous business week and year-to-date starting 2/1/2021.&nbsp; What adjustments can i make to the search below that will pull that?</P><P>index=overwatch-summary overwatch-vuln-type="*"<BR />| where _time&gt;strptime("2021/02/01 00:00:00","%Y/%m/%d %H:%M:%S")<BR />| eval _time=if(_time &lt; now()-86400, now()-86400, now())<BR />| rex field=resource_id "subscriptions/(?&lt;subscriptionId&gt;[0-9a-fA-F\-]+)"<BR />| lookup subscription_managed.csv subscriptionId OUTPUT managed<BR />| fillnull value="Unmanaged" managed<BR />| search managed=Unmanaged<BR />| fillnull value="" blob_name<BR />| eval unique_id=if(isnotnull(unique_id),unique_id,sha256('overwatch-vuln-type' . "_" . resource_id . "_" . issue . blob_name))| chart dc(unique_id) as count over _time| bin _time span=1d<BR />| append<BR />[ stats c<BR />| eval _time=now()<BR />| eval count=0<BR />| bin _time span=1d<BR />| fields _time count ]<BR />| stats sum(count) as count by _time</P> Tue, 09 Mar 2021 22:58:26 GMT https://community.splunk.com/t5/Splunk-Search/Search-that-combines-last-7-days-and-year-to-date/m-p/543120#M153851 jhackle13 2021-03-09T22:58:26Z https://community.splunk.com/t5/Splunk-Search/Search-that-combines-last-7-days-and-year-to-date/m-p/543130#M153854 <P>Previous business week you can get with "snap to" on the relative_time command, so this will calculate the start and end range of week starting on Monday and ending Sunday</P><LI-CODE lang="markup">| eval start_week=relative_time(now(), "-w@w1"), end_week=start_week+(86400 * 7)</LI-CODE><P>&nbsp;Note that your use of&nbsp;</P><P><SPAN>| where _time&gt;strptime("2021/02/01 00:00:00","%Y/%m/%d %H:%M:%S")</SPAN></P><P><SPAN>seems unnecessary, as you can either set that date range from your search time window or just as </SPAN></P><LI-CODE lang="markup">earliest="02/01/2021 00:00:00"</LI-CODE><P>on the search line.</P><P>&nbsp;</P> Wed, 10 Mar 2021 04:10:24 GMT https://community.splunk.com/t5/Splunk-Search/Search-that-combines-last-7-days-and-year-to-date/m-p/543130#M153854 bowesmana 2021-03-10T04:10:24Z