All Apps and Add-ons

How to configure a dashboard Panel to search events only for Monday and Tueeday of the week

in22915110
Engager

Hi Team,

Is it feasible to configure a dashboard panel search to look for events only on Monday and Tuesday? Please let me know if it is possible.

Thanks,
Anilkumar

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @in22915110,
you can use the field date_wday, to choose the days of the week you want, something like this:

index=wineventlog (date_wday="monday" OR date_wday="tuesday")
| table _time ComputerName, user

and save this search as a dashboard panel.

Then you can use
Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @in22915110,
you can use the field date_wday, to choose the days of the week you want, something like this:

index=wineventlog (date_wday="monday" OR date_wday="tuesday")
| table _time ComputerName, user

and save this search as a dashboard panel.

Then you can use
Ciao.
Giuseppe

0 Karma

in22915110
Engager

Hi Ciao,

below is the query I want to modify to look for the events which indexed only on Monday and TuesDay.

index=finance_preprod (date_wday="monday" OR date_wday="tuesday") sourcetype=finance_salesRecon_app_PPE source=frs_integration_engine_PPE message="WEEKLY Feed :*Route file encryption transfer has completed"
| eval event_week_day = strftime(_time,"%w"), event_hour = strftime(_time,"%H"), current_week_day = strftime(now(),"%w"), current_hour = strftime(now(),"%H")
| where event_week_day<=2 AND event_hour<=14
| stats count as weekly_feeds

I tried with your answer, but its not working. Could you please help me to modify the query?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @in22915110,
your search can be easier:

index=finance_preprod (date_wday="monday" OR date_wday="tuesday") sourcetype=finance_salesRecon_app_PPE source=frs_integration_engine_PPE message="*WEEKLY Feed :Route file encryption transfer has completed" date_hour<=14
| stats count as weekly_feeds

Ciao.
Giuseppe

0 Karma

in22915110
Engager

Hi @gcusello,
Your query is not helping me to search the required events, could you please share me the document reference for (date_wday="monday" OR date_wday="tuesday") or date_hour - all implicit fields??

are these implicit fields derived from event indexed datetime?

Thanks,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @in22915110,
if you run your search in verbose mode, in the interesting fields you can find many fields as date_wday or date_hour that are automatically extracted from _time by default, so you don't need to use eval command to extract them.
You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usedefaultfields .

Why (date_wday="monday" OR date_wday="tuesday") date_hour<=14 cannot replace | eval event_week_day = strftime(_time,"%w"), event_hour = strftime(_time,"%H") | where event_week_day<=2 AND event_hour<=14 for you?
what's the problem? can I help you?

Ciao.
Giuseppe

0 Karma

in22915110
Engager

Hi @gcusello,

Yes, the implicit variables are not working for me,

I just tried to replace the event_hour with date_hour and the query fails to fetch the events.

Please find the screenshots below for your reference
https://ibb.co/crf9Lrr
https://ibb.co/JCKf9fj

Please let me know if you find any issue in the query

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @in22915110,
It's very strange, because if I run

index=wineventlog (date_wday="monday" OR date_wday="tuesday") date_hour<="14"

I have results! (in Fast, Smart and Verbose Mode)
Only for my curiosity, have the search with date_hour results in Verbose Mode?

Anyway, coming back to your question: if your search gives results, what's the problem to save it in a dashboard panel?

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @in22915110,
I found in https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usedefaultfields
that "Only events that have timestamp information in them as generated by their respective systems will have date_* fields".
probably this is the problem!
how are the timestamps of your events generated?
Anyway, coming back to your question: if your search gives results, what's the problem to save it in a dashboard panel?

ciao.
Giuseppe

0 Karma

in22915110
Engager

Hi @gcusello,

Thanks for giving some clarity on the question. I am able to save the result as dashboard panel.

I am already filtering the events for Monday and Tuesday. I was just checking if there is a better way to achieve this.

Thanks for your help, I will try to add timestamp to the events and try.

Thanks.

0 Karma

in22915110
Engager

@gcusello

When I run the search in verbose mode I dont see date_hour or date_wday in the interesting fields, may that is the reason??

If so, how these fields can be added to the list?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...