topic Re: How to exclude weekends from last 30 days search ? in Splunk Search

How to exclude weekends from last 30 days search ?

zacksoft — Fri, 18 May 2018 15:01:16 GMT

My query essentially goes thru every event and picks a field with response_time. And then calculates the average value of it.
I need to do this search for last 30 days excluding weekends(saturday,sunday). But in the presets I don't see any option to exclude weekend. Need help for that.

Re: How to exclude weekends from last 30 days search ?

solarboyz1 — Tue, 29 Sep 2020 19:38:55 GMT

Something like...
index=main date_wday!=saturday AND date_wday!=sunday

Re: How to exclude weekends from last 30 days search ?

peterfox1992 — Thu, 24 Mar 2022 13:51:00 GMT

Hi @solarboyz1 , How can I have this as a customized input button ?

Re: How to exclude weekends from last 30 days search ?

solarboyz1 — Thu, 24 Mar 2022 13:56:25 GMT

You would need to create something like a checkbox on your form that says something like "Exclude Weekends" or "Week Days Only"

When that checkbox is selected, have it add the "date_wday!=saturday AND date_wday!=sunday" to your base search.

Re: How to exclude weekends from last 30 days search ?

peterfox1992 — Thu, 24 Mar 2022 15:16:30 GMT

@solarboyz1, Thanks for the reply.

Created input option like this. Working as expected but what I noticed is Tick mark is not changing when I select the other option; showing both buttons as Checked. Any suggestions ?

<input type="checkbox" token="weekends" id="weekends">
<label>Weekend Option</label>
<choice value="| where NOT (date_wday=&quot;saturday&quot; OR date_wday=&quot;sunday&quot;)">Exclude Weekend</choice>
<choice value="">Include Weekend</choice>
<delimiter> </delimiter>
</input>

Re: How to exclude weekends from last 30 days search ?

solarboyz1 — Mon, 28 Mar 2022 12:49:08 GMT

Tick mark is not changing when I select the other option

I'm going to infer that you are using the timechart to visualize the data, and the timechart still has weekends on the x axis.

I believe You will need to switch from timechart to using chart over _time

Which should give you a chart without any weekends.