Reporting

Exclude Saturday and Sunday from monthly repirt

priya0709
Path Finder

I wanted to update my query to exclude Saturday and Sunday from attached query which is running for last 30 days

Please suggest

Query searches for host which generated event code 52 in last 30 days

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6

View solution in original post

0 Karma

gcusello
Legend

Hi @priya0709,

you could also add to your main search:

your_main_search NOT (date_wday="saturday" OR date_wday="sunday")
| ...

Ciao.

Giuseppe 

Tags (1)

ITWhisperer
SplunkTrust
SplunkTrust
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...