Count the number of events but avoid counting weekend days

[mtmoore]

How would one filter out weekends in a count of events based on a search? Filter so that those days are not included in anyway... i.e. avoiding 0s in your final output due to the weekends.

[somesoni2]

Try out following

index="MSExchange" sourcetype="MSExchange:2010:MessageTracking" eventtype="storedriver-deliver"  | timechart count as NoofMessages | eval date_wday=lower(strftime(_time,"%A")) |where NOT (date_wday=saturday OR date_wday=sunday) | fields - date_wday| predict NoofMessages future_timespan=180

[mtmoore]

That was the answer but with one modification... date_wday=saturday etc... the day needed to be surrounded in quotes i.e. date_wday="saturday". Thankyou very much!

[royimad]

Using the predefined date_wday on the events you can exclude weekends

sourcetype="testcsvlog" (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday) | ....

[mtmoore]

throw everything out for |predict.

How can this be avoided?

[mtmoore]

The problem with the above is that it replaces the 2 days with 0s. Therefore, if you pipe the search into |predict, it skewers the results.. I want those 2 days totally removed from the equation.

Here is my search:

index="MSExchange" sourcetype="MSExchange:2010:MessageTracking" eventtype="storedriver-deliver" (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday) | timechart count as NoofMessages | predict NoofMessages future_timespan=180

In the above example for your search data you get Fri 1000, Sat 0, Sunday 0, Tues 2500... the 0s