Dashboards & Visualizations

Alter time range based on day of the week

bruceclarke
Contributor

All,

I have a saved report/dashboard panel that I want to run daily to aggregate stats over the last day. However, I want the search to run over the last three days on Monday (i.e. run the search over the entire weekend).

Is there any way to add this kind of conditional logic to a saved search? In other words, can I change the time range based on the current day of the week?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

View solution in original post

woodcock
Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

somesoni2
Revered Legend

You can override the search time range from the query itself. Assuming the time range for your panel is "Yesterday" OR simply "-1d@d to @d", then add following subsearch at the start of your search (base search before first pipe) to do the same.

your base search [| gentimes start=-1 | addinfo | eval earliest=if(strftime(now(),"%a")="Mon",info_min_time - (2*86400),info_min_time) | eval latest=info_max_time | table earliest latest | format ] | rest of your search here....

Explanation : The subsearch get the current time range (yesterday) by running command addinfo. Then it checks today's day [strftime(now(),"%a")] is Monday or not, if it's monday, instead of current -1d@d earliest, use -3d@d (substracting 2 more days). The latest will remain same and updated earliest and latest values are returned.

Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...