Reporting

Exclude Saturday and Sunday from monthly repirt

priya0709
Path Finder

I wanted to update my query to exclude Saturday and Sunday from attached query which is running for last 30 days

Please suggest

Query searches for host which generated event code 52 in last 30 days

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @priya0709,

you could also add to your main search:

your_main_search NOT (date_wday="saturday" OR date_wday="sunday")
| ...

Ciao.

Giuseppe 

mark_groenveld
Path Finder

I tried this and it still showed results for a stats or timechart output.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...