I tried to use the preset time definition of Business week until now, but it take Monday-Friday, while we are working on Sunday-Thursday.
Is there any way to change it permanently?
@Zivanko - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.
You can go to Setting>User Interface>Time Ranges>Add New (or edit it, if you have one in place) and place the earliest time at @w0
and latest time to @w4
and you can make this a public global time range
Copy the stanzas you want to change from $SPLUNK_HOME/etc/system/default/times.conf to $SPLUNK_HOME/etc/system/local/times.conf. Then change "@w1" to "@w0" and "@w5" to "@w4" in the appropriate places. You'll probably have to restart Splunk for the changes to take effect.