Dashboards & Visualizations

Alter time range based on day of the week

bruceclarke
Contributor

All,

I have a saved report/dashboard panel that I want to run daily to aggregate stats over the last day. However, I want the search to run over the last three days on Monday (i.e. run the search over the entire weekend).

Is there any way to add this kind of conditional logic to a saved search? In other words, can I change the time range based on the current day of the week?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

View solution in original post

woodcock
Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

somesoni2
Revered Legend

You can override the search time range from the query itself. Assuming the time range for your panel is "Yesterday" OR simply "-1d@d to @d", then add following subsearch at the start of your search (base search before first pipe) to do the same.

your base search [| gentimes start=-1 | addinfo | eval earliest=if(strftime(now(),"%a")="Mon",info_min_time - (2*86400),info_min_time) | eval latest=info_max_time | table earliest latest | format ] | rest of your search here....

Explanation : The subsearch get the current time range (yesterday) by running command addinfo. Then it checks today's day [strftime(now(),"%a")] is Monday or not, if it's monday, instead of current -1d@d earliest, use -3d@d (substracting 2 more days). The latest will remain same and updated earliest and latest values are returned.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...