Function To Return Last Weekday?

[andrewkenth]

Is there a function to return the last weekday?

Instead of:

relative_time(now(), "-1d@d") 

Is there any notation to say workday or weekday?

[andrewkenth · Accepted solution]

That did not seem to work. Instead I used a case to check the day of the week:

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

[linu1988]

@w-1d would take

[somesoni2]

Some reading here

http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/SearchTimeModifiers