Reporting

## Change report sending time logic

Explorer

I have a report where it counts the events for the "next weekend", this meaning the following:

1.“Weekend” is considered the interval between Friday - 4 pm and Monday - 8 am.

2.: “Next” is to be considered with this rule: from Monday to Thursday, is the coming week and from Friday to Sunday, is the weekend after the next one.

Example: before June, Friday 4th, the interval 4/6 - 7/6 is considered the next weekend, on Friday 4th the interval 4/6 - 7/6 becomes this weekend , 11/6 – 14/6 becomes next weekend.

Issue: The report is scheduled at 8AM each day, but the Friday one is not considering the upcoming weekend as the "next weekend", rather taking the future weekend which will take place in 7 days.

I need help in understanding how to change the logic of this report, to have it also on Friday filled with the next weekend results, meaning the first and second day right after. Hope it makes sense.

``````| eval start = strptime( 'Scheduled Start' ,"%Y-%m-%d %H:%M")
| eval end = strptime( 'Scheduled End' ,"%Y-%m-%d %H:%M")
| eval "Scheduled Start" = strftime(start , "%Y-%m-%d %H:%M")
| eval "Scheduled End" = strftime(end , "%Y-%m-%d %H:%M")
| eval nextFriday =if( strftime(now(),"%w")=="5" OR strftime(now(),"%w")=="6" OR strftime(now(),"%w")=="0",relative_time(now() , "+1w@w5+16h"), relative_time(now() , "@w5+7d+16h"))
| eval nextMonday = relative_time(nextFriday , "+3d@d+8h")
| eval nextMondayS = strftime(nextMonday , "%Y-%m-%d %H:%M")
| eval nextFridayS1 = strftime(nextFriday , "%Y-%m-%d %H:%M")
| where start >= nextFriday AND start <= nextMonday ``````

Labels (3)

• ### scheduled search

Get Updates on the Splunk Community!

#### Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

#### Observability Newsletter Highlights | March 2023

March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...