Splunk Enterprise

How do I change the business week to be Sunday-Thursday instead of Monday-Friday?

Zivanko
New Member

I tried to use the preset time definition of Business week until now, but it take Monday-Friday, while we are working on Sunday-Thursday.
Is there any way to change it permanently?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@Zivanko - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

cmerriman
Super Champion

You can go to Setting>User Interface>Time Ranges>Add New (or edit it, if you have one in place) and place the earliest time at @w0 and latest time to @w4and you can make this a public global time range

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Copy the stanzas you want to change from $SPLUNK_HOME/etc/system/default/times.conf to $SPLUNK_HOME/etc/system/local/times.conf. Then change "@w1" to "@w0" and "@w5" to "@w4" in the appropriate places. You'll probably have to restart Splunk for the changes to take effect.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...