Trending license usage

[rmorlen]

We have a summary index where we collect daily license usage. We have a chart that can show me the daily usage for the last few months.

I would like to have a trendline that shows the usage over the past few months. I would like to only include Monday-Friday (or only exclude weekends).

I chart the following (summary_admin is our summary index):

index=summary_admin earliest=-4mon@mon latest=@d | timechart useother="f" span=1d max(GB) by orig_sourcetype | addtotals fieldname=GBTotal | timechart span=1w avg(GBTotal) as "Average", max(GBTotal) as "Max", min(GBTotal) as "Min"

Does ok but would be better by eliminating weekends. (I also need to tweak the span options.)

Thanks.

[yannK]

check the automatic date fields like date_wday
and use it as an eval or where condition to exclude or turn into zero.

| eval GB=if(date_wday="saturday" OR date_wday="sunday",0)

[rmorlen]

Thanks for the input. Setting the values for Sat and Sun to 0 skew the averages, min, and max. I really want to completely ignore them.