Display table base on the if condition

[syedikramulla]

Hi,

I want to count the LOGLEVEL only for weekdays.  If there's not logs then the query should return '0'.  Can you please help me to correct this query.

index="XYZ" sourcetype=Logs LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO|eval Day=strftime(_time,"%w")|
eval DayType=if((Day >=0) AND (Day <=6) ,"WeeekDay","WeekEnd") | If(DayType=="WeekDay", count(LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO),'0')

Regards,

Syed

[syedikramulla]

thank you

[tscroggins · Accepted solution]

@syedikramulla 

The date_wday field may already be extracted from your events, but but be mindful of time zone differences between the raw data and your Splunk settings:

index="XYZ" sourcetype=Logs (LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO) date_wday!=saturday date_wday!=sunday
| timechart span=1d count

If date_wday isn't present or if you don't trust the vale:

index="XYZ" sourcetype=Logs (LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO)
| eval Day=strftime(_time, "%w")
| where Day>0 AND Day<6
| timechart span=1d count