Alter time range based on day of the week

[bruceclarke]

All,

I have a saved report/dashboard panel that I want to run daily to aggregate stats over the last day. However, I want the search to run over the last three days on Monday (i.e. run the search over the entire weekend).

Is there any way to add this kind of conditional logic to a saved search? In other words, can I change the time range based on the current day of the week?

Thanks!

[woodcock · Accepted solution]

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

[somesoni2]

You can override the search time range from the query itself. Assuming the time range for your panel is "Yesterday" OR simply "-1d@d to @d", then add following subsearch at the start of your search (base search before first pipe) to do the same.

your base search [| gentimes start=-1 | addinfo | eval earliest=if(strftime(now(),"%a")="Mon",info_min_time - (2*86400),info_min_time) | eval latest=info_max_time | table earliest latest | format ] | rest of your search here....

Explanation : The subsearch get the current time range (yesterday) by running command addinfo. Then it checks today's day [strftime(now(),"%a")] is Monday or not, if it's monday, instead of current -1d@d earliest, use -3d@d (substracting 2 more days). The latest will remain same and updated earliest and latest values are returned.