topic Re: Search bar previous week in Splunk Search

Search bar previous week

mrovira — Thu, 25 Mar 2021 12:46:04 GMT

Hello,

I've around questions and answers but I cannot find the one I need.

I'm selecting previous week in the time range when searching, and Splunk is starting the week on Sunday. How or What I need to change to make it start the week on Monday for all the users?

I want to change it in the search bar, without making people to add earliest/latest or similar in the search.

I'm sure is something easy, but I cannot find it.

Thank you in advance!

Re: Search bar previous week

richgalloway — Thu, 25 Mar 2021 13:05:13 GMT

Go to Settings->User interface->Time ranges and add a new time range defined as "-w@w1".

Re: Search bar previous week

SOURAV_S — Thu, 25 Mar 2021 13:45:22 GMT

Hi @mrovira,

Please check if this instruction works for you:

Click on Settings
Click on User Interface under 'Knowledge' sub-section.
Click on Time Ranges
Click on New Time Range on top right hand corner
Since you want previous week Monday to be starting point, configure your new time range as follows:
1. Set earliest field as -5d@w1 (to denote previous Monday)
2. Set latest field as @w6 (to denote Saturday, use @w5 for Friday)
Make sure about your destination app.

These changes are available only for your user. To share it with everyone else, make sure you are admin and change the permissions. To configuring the time range to be available globally for all apps, and available for everyone to use and admins to modify:

Settings > Time Ranges > your_custom_time_range_picker > Permissions

Object should appear in All apps (system)
Permissions: Read - Everyone, Write - admin

You're all done!

If this helps, mark this as solution.

Happy Splunking! 🙂

Re: Search bar previous week

mrovira — Wed, 07 Apr 2021 09:30:44 GMT

Hello,

You both were right, but I just can mark one as the solution 😞 Even though I used what you both said.

Thank you for your reply and time, it helped me! 😊