Calculate weekdays assuming Saturday as 1/2 day

[changux]

Hi.
I want to calculate the weekdays in a month, using this:

| gentimes start=11/01/16 end=11/31/16 | search starthuman!="Sun*" starthuman!="Sat*" | stats count

My problem is that i need to count the saturdays as 1/2 day, for example: Without Sat/Sun, July has 21 weekdays. July has 4 saturdays, so i must add 0.5 * 4, then, the total count is 23. How i can do this?

Any help please?

Thanks!

[sundareshr · Accepted solution]

Try this

| gentimes start=11/01/16 end=11/31/16 | eval dow=strftime(starttime, "%w")  | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

*UPDATED*

| makeresults | eval start=relative_time(now(), "@mon") | eval end=relative_time(now(), "+1mon@mon-1d") | eval mon=mvrange(start, end, "1d") | mvexpand mon | eval dow=strftime(mon, "%-w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

[changux]

Awesome! Some way to do to the current month and delete start/end dates?

[sundareshr]

Try updated answer

[changux]

Last question: i created a search macro with this and when i ran, splunk returns:

Error in 'makeresults' command: This
command must be the first command of a
search.

Any idea?

[PPape]

can you show us where you use the macro?

[changux]

After created, i try to call in the search bar: workdayswithsat

With ` begin/end

[sundareshr]

You probably don't need |makeresults. Try without it.

[PPape]

This should work

| gentimes start=11/01/16 end=11/31/16  | search starthuman!="Sun*" |rex field=starthuman "^(?<day>\C{3}).*" | eval daycount = if(day=="Sat",0.5,1) | stats sum(daycount)

[changux]

Awesome! Some way to do to the current month and delete start/end dates?

[PPape]

try @sundareshr updated answer 🙂 this is really great