Archive

Function To Return Last Weekday?

andrewkenth
Communicator

Is there a function to return the last weekday?

Instead of:

relative_time(now(), "-1d@d") 

Is there any notation to say workday or weekday?

Tags (2)
0 Karma
1 Solution

andrewkenth
Communicator

That did not seem to work. Instead I used a case to check the day of the week:

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

View solution in original post

0 Karma

andrewkenth
Communicator

That did not seem to work. Instead I used a case to check the day of the week:

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

View solution in original post

0 Karma

linu1988
Champion

@w-1d would take

0 Karma

somesoni2
Revered Legend
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!