Dashboards & Visualizations
Highlighted

How to skip the weekends in the timechart or a chart?

Path Finder

I have a search query which yields a timechart . I want to show just the weekdays and skip the weekends in the charting of data using timechart. 

I have used the clause | eval day_of_week = strftime(_time,"%A")
| where NOT (day_of_week="Saturday" OR day_of_week="Sunday")
| fields - day_of_week in my query before and after the timechart.

The data doesn't have the weekend information whereas when this is charted using the timechart I always get the weekends on my x-axis.

 

Any idea how to solve it?

Labels (2)
0 Karma
Highlighted

Re: How to skip the weekends in the timechart or a chart?

Explorer

Hello!

Try in this order

[...]

| where NOT date_wday in ("Saturday","Sunday")
| eval day_of_week = strftime(_time,"%A")

[...]

0 Karma
Highlighted

Re: How to skip the weekends in the timechart or a chart?

Path Finder

Hi , thanks for the reply. I had tried the same with the clause before and after the chart command. It didn't work for me in either case.

However the following worked for me. I am not not sure though why it worked and what is Splunk's behavior when I used strftime.

| eval date=strftime(_time,"%d-%b-%y %H:%M:%S %a")
| chart limit=0 useother=false count as Volume by date,Description

 

0 Karma
Highlighted

Re: How to skip the weekends in the timechart or a chart?

Ultra Champion

sample:

| tstats count where index=_internal earliest=0 by _time span=1d
| eval weekday=if(strftime(_time,"%w") = "0" OR strftime(_time,"%w") = "6",1,0)
| where weekday=0
| eval weekday=strftime(_time,"%a")

reference:https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables 

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.