Hi,
I want to count the LOGLEVEL only for weekdays. If there's not logs then the query should return '0'. Can you please help me to correct this query.
index="XYZ" sourcetype=Logs LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO|eval Day=strftime(_time,"%w")|
eval DayType=if((Day >=0) AND (Day <=6) ,"WeeekDay","WeekEnd") | If(DayType=="WeekDay", count(LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO),'0')
Regards,
Syed
The date_wday field may already be extracted from your events, but but be mindful of time zone differences between the raw data and your Splunk settings:
index="XYZ" sourcetype=Logs (LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO) date_wday!=saturday date_wday!=sunday
| timechart span=1d countIf date_wday isn't present or if you don't trust the vale:
index="XYZ" sourcetype=Logs (LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO)
| eval Day=strftime(_time, "%w")
| where Day>0 AND Day<6
| timechart span=1d count
thank you
The date_wday field may already be extracted from your events, but but be mindful of time zone differences between the raw data and your Splunk settings:
index="XYZ" sourcetype=Logs (LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO) date_wday!=saturday date_wday!=sunday
| timechart span=1d countIf date_wday isn't present or if you don't trust the vale:
index="XYZ" sourcetype=Logs (LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO)
| eval Day=strftime(_time, "%w")
| where Day>0 AND Day<6
| timechart span=1d count