Reporting

Exclude Saturday and Sunday from monthly repirt

priya0709
Path Finder

I wanted to update my query to exclude Saturday and Sunday from attached query which is running for last 30 days

Please suggest

Query searches for host which generated event code 52 in last 30 days

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @priya0709,

you could also add to your main search:

your_main_search NOT (date_wday="saturday" OR date_wday="sunday")
| ...

Ciao.

Giuseppe 

mark_groenveld
Path Finder

I tried this and it still showed results for a stats or timechart output.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...