Dashboards & Visualizations

Alter time range based on day of the week

Contributor

All,

I have a saved report/dashboard panel that I want to run daily to aggregate stats over the last day. However, I want the search to run over the last three days on Monday (i.e. run the search over the entire weekend).

Is there any way to add this kind of conditional logic to a saved search? In other words, can I change the time range based on the current day of the week?

Thanks!

0 Karma
1 Solution

Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

View solution in original post

Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

View solution in original post

Revered Legend

You can override the search time range from the query itself. Assuming the time range for your panel is "Yesterday" OR simply "-1d@d to @d", then add following subsearch at the start of your search (base search before first pipe) to do the same.

your base search [| gentimes start=-1 | addinfo | eval earliest=if(strftime(now(),"%a")="Mon",info_min_time - (2*86400),info_min_time) | eval latest=info_max_time | table earliest latest | format ] | rest of your search here....

Explanation : The subsearch get the current time range (yesterday) by running command addinfo. Then it checks today's day [strftime(now(),"%a")] is Monday or not, if it's monday, instead of current -1d@d earliest, use -3d@d (substracting 2 more days). The latest will remain same and updated earliest and latest values are returned.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!