Extract data for weekends.

[mmukherjee]

Hi,
I need to calculate the amount of time for which a server was used in the weekends. For that I am using the following search string :

index="history" source = "DetailedLogs" | transaction source | convert ctime(_time) AS day_of_week timeformat="%A" | convert ctime(_time) AS day timeformat="%e" | eval weekendno = case(day>=1 AND day <=7 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 1", day>7 AND day<=14 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 2",day>14 AND day <=21 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 3",day>21 AND (day_of_week=="Saturday" OR day_of_week=="Sunday"),"Weekend 4") | chart count(duration) by weekendno

1. Firstly, after executing the search string, I am getting results of usage of the server on weekdays as well. So, clearly there's something wrong with it. Can someone point out the mistake or is there any better approach to achieve the same result?

2. Also, I want to count the total duration of usage, for which I should use the sum() function but it is giving me an error.

3. What is the default unit of the "duration" field? Is it seconds or hours?

PFA attached the screenshots. One of the event fetched has a timestamp "08-29-2017:11:41:42" which is a Tuesday.

Thanks

[gcusello · Accepted solution]

Hi
I'd use the date_wday field to filer week-end's events

index="history" source = "DetailedLogs" (date_wday=sunday OR date_wday=saturday)
| transaction source maxspan=72h
| timechart sum(duration) AS duration

Duration is expressed in seconds, if you like you can express it using eval at the end of the search

| eval duration=tostring(duration,"duration")

Bye.
Giuseppe