Dashboards & Visualizations

Alter time range based on day of the week

bruceclarke
Contributor

All,

I have a saved report/dashboard panel that I want to run daily to aggregate stats over the last day. However, I want the search to run over the last three days on Monday (i.e. run the search over the entire weekend).

Is there any way to add this kind of conditional logic to a saved search? In other words, can I change the time range based on the current day of the week?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

View solution in original post

woodcock
Esteemed Legend

Like this:

YourBaseSearchHere latest=now() [ | noop | stats count AS earliest | eval earliest=strftime(now(), "%A") | eval earliest=if(earliest="Monday", "-3d@d", "-1d@d") ]

This totally overrides your the saved search parameters and does "last 3 days" on Mondays and "last day" otherwise.

somesoni2
SplunkTrust
SplunkTrust

You can override the search time range from the query itself. Assuming the time range for your panel is "Yesterday" OR simply "-1d@d to @d", then add following subsearch at the start of your search (base search before first pipe) to do the same.

your base search [| gentimes start=-1 | addinfo | eval earliest=if(strftime(now(),"%a")="Mon",info_min_time - (2*86400),info_min_time) | eval latest=info_max_time | table earliest latest | format ] | rest of your search here....

Explanation : The subsearch get the current time range (yesterday) by running command addinfo. Then it checks today's day [strftime(now(),"%a")] is Monday or not, if it's monday, instead of current -1d@d earliest, use -3d@d (substracting 2 more days). The latest will remain same and updated earliest and latest values are returned.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...