How can we exclude weekends from the count of the number of days for the age of a ticket?

[splunker9999]

Hi ,

We have a field called AGING which tells how many days a ticket exists.

In order to get the accurate age, we want to subtract weekends from the AGING field.

For example: If aging has value of 30 days, we need to exclude all Saturdays and Sundays from these 30 days and need to output the results.

Can you please help?

Thanks.

[sundareshr]

Try this

... | eval end=_time | eval start=end-(aging*86400)| eval range=mvrange(start, end, 86400) | convert ctime(range) timeformat="%+" | eval BusinessDays=mvcount(mvfilter(NOT match(range,"(Sun|Sat).*"))) 

[woodcock]

Brilliant; I learned mvrange today!