Splunk Search

excluding weekends and overnights from plotted results

stringbean
New Member

I'm trying to plot the average figure from a set of results, however I want to exclude weekends and overnight as the figure i'm interested in (in this case wifi clients RSSI) would be skewed as they are stored in areas with poor coverage overnight\weekends. I'm only interested in the signal strength during the day while they are in use.

How would I achieve this - my current search (which works fine but includes overnight & weekends)) looks like this:

sourcetype="clientinfo" ClientMac!=ClientMac Environment="B"
| bucket span=24h _time
| search (RSSI>-76)
| timechart span=1d avg(RSSI)

Thanks

0 Karma

niketn
Legend

@stringbean have you tried using date_wday and date_hour fields for this filtering?

Following is a run anywhere example from Splunk's _internal index which returns results from weekday i.e. excluding Saturday and Sunday and hours from 8 AM to 6 PM

index=_internal sourcetype=splunkd log_level=ERROR NOT (date_wday IN ("saturday","sunday")) AND date_hour IN (8,9,10,11,12,13,14,15,16,17,18)
| chart count as Error by date_wday date_hour
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sandeepmakkena
Contributor

| bucket span=24h _time
| eval Hour = strftime(_time,"%H")
| eval day_of_week = strftime(_time,"%A")
| search (RSSI>-76 AND RSSI!=-128) AND (day_of_week!="Saturday" AND day_of_week!="Sunday") AND (Hour >= day_starting OR Hour<= day_ending)
| timechart span=1d avg(RSSI)

This should give you what you are looking for.

0 Karma

stringbean
New Member

That seems to work, just validating the results now, thanks

0 Karma

stringbean
New Member

I've figured out how to exclude weekends using the following but still need help with overnight:

sourcetype="clientinfo" ClientMac!=ClientMac Environment="B"
| bucket span=24h _time
| eval day_of_week = strftime(_time,"%A")
| search (RSSI>-76 AND RSSI!=-128) AND (day_of_week!="Saturday" AND day_of_week!="Sunday")
| timechart span=1d avg(RSSI)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...