Can timewrap be utilized to only use weekdays?

Builder

Can timewrap be utilized to only use weekdays?

Specifically, if I am searching from a Monday for a daily report, can I skip Saturday and Sunday and use the timewrap utility to chart Friday? We want to be able to skip Saturdays and Sundays when we use the daily comparison of timewrap.

Thanks!

Tags (1)
1 Solution
SplunkTrust

You could do something like this, run over -7d@d to @d+d in my case:

``````| tstats prestats=t count where index=_internal by _time span=1h | timechart span=1h count
| eval wday = strftime(_time, "%a") | where wday != "Sat" AND wday != "Sun" | fields - wday
| timewrap d
``````

The first line loads an example timechart, the second throws out Saturdays and Sundays, and finally it runs `timewrap`. I get a chart for latest_day, 1day_before, 2days_before, 5days_before, 6days_before, 7days_before - note how 3 and 4 days before are missing, those would be Saturday and Sunday.

SplunkTrust

You could do something like this, run over -7d@d to @d+d in my case:

``````| tstats prestats=t count where index=_internal by _time span=1h | timechart span=1h count
| eval wday = strftime(_time, "%a") | where wday != "Sat" AND wday != "Sun" | fields - wday
| timewrap d
``````

The first line loads an example timechart, the second throws out Saturdays and Sundays, and finally it runs `timewrap`. I get a chart for latest_day, 1day_before, 2days_before, 5days_before, 6days_before, 7days_before - note how 3 and 4 days before are missing, those would be Saturday and Sunday.

Builder

Perfect! Thank you!!

Builder

Yes, however, I want to skip Saturday's and Sunday's. I wasn't sure if that could be done utilizing Timewrap.

SplunkTrust

So... you are doing a "compare today with the last X working days" report?

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...