topic Re: Function To Return Last Weekday? in Splunk Search

Function To Return Last Weekday?

andrewkenth — Tue, 20 May 2014 18:22:35 GMT

Is there a function to return the last weekday?

Instead of:

relative_time(now(), "-1d@d")

Is there any notation to say workday or weekday?

somesoni2 — Tue, 20 May 2014 18:56:03 GMT

Some reading here

linu1988 — Tue, 20 May 2014 19:22:01 GMT

@w-1d would take

andrewkenth — Mon, 28 Sep 2020 16:40:42 GMT

That did not seem to work. Instead I used a case to check the day of the week:

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))