Splunk Enterprise

How do I change the business week to be Sunday-Thursday instead of Monday-Friday?

Zivanko
New Member

I tried to use the preset time definition of Business week until now, but it take Monday-Friday, while we are working on Sunday-Thursday.
Is there any way to change it permanently?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@Zivanko - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

cmerriman
Super Champion

You can go to Setting>User Interface>Time Ranges>Add New (or edit it, if you have one in place) and place the earliest time at @w0 and latest time to @w4and you can make this a public global time range

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Copy the stanzas you want to change from $SPLUNK_HOME/etc/system/default/times.conf to $SPLUNK_HOME/etc/system/local/times.conf. Then change "@w1" to "@w0" and "@w5" to "@w4" in the appropriate places. You'll probably have to restart Splunk for the changes to take effect.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...