Is there an equivalent or something like Networkdays from excel in Splunk??
I want to calculate the duration between two dates and exclude from the calculation all the weekends and holidays.
Ex. Startdate = Dec. 30, 2013, Enddate = Jan. 4, 2014
I want to get the duration between above dates. Note that Jan. 1, is holiday and assuming that Jan, 2, 3 would be weekends.
| gentimes start=-1 | eval CreateDateEpoch="1412136000" | table CreateDateEpoch | eval start=relative_time(CreateDateEpoch,"@d") | eval end=relative_time(now(),"@d") | eval Date=mvrange(start,end+86400,86400) | convert ctime(Date) timeformat="%+" | eval NoOfBusinessDays=mvcount(mvfilter(NOT match(Date,"(Sun|Sat).*")))
I am able to create a lookup with all the holidays, but I am not able to filter using the lookup output fields. The "match" expression uses a regex.
For example, I have a new fields from lookup called "Holidaylist". Your idea was something like below??(correct me if I'm wrong)
mvfilter(not match(Date, Holidaylist)), wherein the "Date" will be filtered based on the contents of the "Holiday_list" fields.