https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212943#M62396 <P>Try like this. This will change the earliest and latest (time range) based on today.</P> <PRE><CODE> source="##" RC="*" SN="*" [| gentimes start=-1 | eval earliest=if(lower(strftime(now(),"%A"))="monday", "-3d@d-4h", "-1d@d-4h") | eval latest="@d-4h" | table earliest, latest | format "" "" "" "" "" ""] | chart count by RC, SN </CODE></PRE> Mon, 26 Sep 2016 13:56:18 GMT somesoni2 2016-09-26T13:56:18Z https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212942#M62395 <P>Hey,<BR /> I want to display the results on a table. it works depending on the timeRange picker when I want it to display results depending on my eval function!!<BR /> This is my search:</P> <PRE><CODE>source="##" RC="*" SN="*" [search source="##" | head 1 | eval earliest=if(date_wday="monday", "-3d@d-4h", "-1d@d-4h") | eval latest=if(date_wday="monday", "@d-4h", "@d-4h") | table earliest, latest | format "" "" "" "" "" ""] | chart count by RC, SN </CODE></PRE> <P>It doesn't work when It's Monday, I want the search from Friday at 8AM until Monday at 8AM and If it's another day, I want the search results to be from the -d at 8AM until the current day at 8AM.<BR /> Can you help me, Please?</P> Mon, 26 Sep 2016 09:55:17 GMT https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212942#M62395 sweetlile 2016-09-26T09:55:17Z https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212943#M62396 <P>Try like this. This will change the earliest and latest (time range) based on today.</P> <PRE><CODE> source="##" RC="*" SN="*" [| gentimes start=-1 | eval earliest=if(lower(strftime(now(),"%A"))="monday", "-3d@d-4h", "-1d@d-4h") | eval latest="@d-4h" | table earliest, latest | format "" "" "" "" "" ""] | chart count by RC, SN </CODE></PRE> Mon, 26 Sep 2016 13:56:18 GMT https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212943#M62396 somesoni2 2016-09-26T13:56:18Z https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212944#M62397 <P>Sorry it doen't work I don't know why,<BR /> this is what I used as a solution:</P> <PRE><CODE>source="##" RC="*" SN="*" [search source="##" | head 1 | eval date_wday = strftime(_time, "%A") |eval earliest=if(date_wday="Monday", "-3d@d+8h", "-1d@d+8h") | eval latest=if(date_wday="Monday", "@d+8h", "@d+8h") | table earliest, latest | format "" "" "" "" "" ""] | chart count over RC by SN </CODE></PRE> Mon, 26 Sep 2016 14:48:41 GMT https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212944#M62397 sweetlile 2016-09-26T14:48:41Z https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212945#M62398 <P>I can see you've changed the earliest and latest calculation, from the one mentioned in the question. Give this a try now..</P> <PRE><CODE>source="##" RC="*" SN="*" [| gentimes start=-1 | eval earliest=if(lower(strftime(now(),"%A"))="monday", "-3d@d+8h", "-1d@d+8h") | eval latest=if(lower(strftime(now(),"%A"))="monday", "@d+8h", "@d+8h") | table earliest, latest | format "" "" "" "" "" ""] | chart count by RC, SN </CODE></PRE> Mon, 26 Sep 2016 15:10:36 GMT https://community.splunk.com/t5/Splunk-Search/Set-earliest-and-latest-using-a-variable-depending-on-the/m-p/212945#M62398 somesoni2 2016-09-26T15:10:36Z