topic Re: How do I exclude Mondays from a Timechart in Splunk Search

How do I exclude Mondays from a Timechart

splunkuser2127 — Fri, 24 Sep 2021 16:22:28 GMT

There are no data on Mondays so my timecharts always dip to 0.

{search string} | eval date_wday=lower(strftime(_time,"%A")) | where NOT (date_wday=monday) | timechart span=1d count by ColName

Is there any way to make the timechart skip Mondays (not just set it to 0)?

Re: How do I exclude Mondays from a Timechart

ITWhisperer — Fri, 24 Sep 2021 18:11:41 GMT

Try this way around

{search string} | timechart span=1d count by ColName | eval date_wday=lower(strftime(_time,"%A")) | where NOT (date_wday=monday)

Re: How do I exclude Mondays from a Timechart

splunkuser2127 — Fri, 24 Sep 2021 19:19:46 GMT

Same result, didn't work.

Re: How do I exclude Mondays from a Timechart

ITWhisperer — Fri, 24 Sep 2021 19:27:49 GMT

{search string} | timechart span=1d count by ColName | eval date_wday=lower(strftime(_time,"%A")) | where NOT (date_wday=monday) | rename _time as time | fieldformat time=strftime(time,"%Y/%m/%d")

Re: How do I exclude Mondays from a Timechart

splunkuser2127 — Fri, 24 Sep 2021 19:37:40 GMT

Same result, it doesn't work. Mondays still show up as 0

Re: How do I exclude Mondays from a Timechart

ITWhisperer — Fri, 24 Sep 2021 23:09:22 GMT

Are you putting Monday in quotes?

Re: How do I exclude Mondays from a Timechart

PickleRick — Sat, 25 Sep 2021 07:27:15 GMT

Depends on what you want to achieve.

Generally, it depends on your timerange. If you want to have data points: Wed, Thu, Fri,Sat,Sun,Tue,Wed and so on, without any "spaces" between sunday and tuesday, you can't do that with simple timechart. As the name implies, timechart does a chart over time so it doesn't mind your data as much as time progress.

You can try timecharting, then filtering out mondays, then doing a chart (not timechart) of remaining values. (can't provide you with a resulting search, I'm on my mobile and don't have access to my splunk installation ATM).

BTW, don't you think it will be confusing for the recipient of your report if you skip every monday (especially if you want do draw a line or barchart from the resulting data)?

Re: How do I exclude Mondays from a Timechart

splunkuser2127 — Mon, 27 Sep 2021 14:34:06 GMT

It doesn't seem to be working for me, I can't turn a timechart into a regular chart (at least not in the way that's useful for me)

Re: How do I exclude Mondays from a Timechart

splunkuser2127 — Mon, 27 Sep 2021 14:34:32 GMT

No, but with or without doesn't work

Re: How do I exclude Mondays from a Timechart

ITWhisperer — Mon, 27 Sep 2021 14:43:35 GMT

Can you share your search as it stands now?

Re: How do I exclude Mondays from a Timechart

splunkuser2127 — Mon, 27 Sep 2021 14:50:58 GMT

This is one attempt:

{search} | timechart span=1d count by ColName | eval date_wday=lower(strftime(_time,"%A")) | where NOT (date_wday=monday) | chart max(date_wday), count by ColName

This is another:

{search} | bin span=1d _time | eval date_wday=lower(strftime(_time,"%A")) | where NOT (date_wday=monday) | chart count by ColName

This second one gives me a regular bar chart xaxis column name y axis count, not sure how to do a multiseries chart over time (without using timechart)

Re: How do I exclude Mondays from a Timechart

ITWhisperer — Mon, 27 Sep 2021 15:05:13 GMT

Try

| rename _time as time
| fieldformat time=strftime(time,"%Y/%m/%d")

As I suggested earlier

_time is treated as a special fieldname by the chart viz and it fills in the gaps e.g. Monday, by renaming it, you avoid that issue.

Re: How do I exclude Mondays from a Timechart

splunkuser2127 — Mon, 27 Sep 2021 15:41:55 GMT

I've tried it in your earlier suggestion, how do you want me to construct the search now?