Splunk Enterprise

How do I change the business week to be Sunday-Thursday instead of Monday-Friday?

New Member

I tried to use the preset time definition of Business week until now, but it take Monday-Friday, while we are working on Sunday-Thursday.
Is there any way to change it permanently?

0 Karma

Splunk Employee
Splunk Employee

@Zivanko - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

Super Champion

You can go to Setting>User Interface>Time Ranges>Add New (or edit it, if you have one in place) and place the earliest time at @w0 and latest time to @w4and you can make this a public global time range

0 Karma

SplunkTrust
SplunkTrust

Copy the stanzas you want to change from $SPLUNKHOME/etc/system/default/times.conf to $SPLUNKHOME/etc/system/local/times.conf. Then change "@w1" to "@w0" and "@w5" to "@w4" in the appropriate places. You'll probably have to restart Splunk for the changes to take effect.

---
If this reply helps you, an upvote would be appreciated.
0 Karma