I need to create a monthly report, which does not select events, which happens on Saturdays and Sundays.
This report should be set up to run on a monthly basis (= select previous month) - but should exclude all Saturdays and Sundays in each month.
How do I set up a monthly report to automatically exclude Saturdays and Sundays?
The base search for the report could exclude Saturdays and Sundays :
index=someindex sourcetype=somesourcetype NOT (date_wday=sunday OR date_wday=saturday) | ...
And the time range in the scheduled report could specify the previous month :
start time = -1mon@mon
finish time = @mon
Then schedule your report to run on the first of each month :
cron = 0 0 1 * *
View solution in original post