Splunk Search

How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n
Path Finder

Hello, was looking at this topic :

https://answers.splunk.com/answers/112838/how-can-you-restrict-a-timechart-to-display-only-weekdays....

My problem is exactly the same. I want to remove Saturdays and Sundays from my timechart. However, it does not seem to work properly in my case, it seems it just ignores them without removing them.

Example below :

alt text

Is there a way to completely remove them from the X-Axis ?

| my base search
| timechart count(foo) as "foo", count(bar) as "bar" span=1d
| eval date_wday=lower(strftime(_time,"%A")) 
| where NOT (date_wday="saturday" OR date_wday="sunday")
| fields - date_wday
Tags (1)
0 Karma
1 Solution

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

View solution in original post

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

sambit_kabi
Path Finder

Lifesaver.  Excellent!! I still couldn't understand how is Splunk treating it differently 

0 Karma

Zakary_n
Path Finder

A problem I discovered with this request, if you guys got any idea.

I created a new question :

https://answers.splunk.com/answers/730248/chart-not-displaying-in-the-right-order.html?minQuestionBo...

0 Karma

Zakary_n
Path Finder

You sir made my day. Very nice workaround. Thank you.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

but the above search will add last week (monday) stats to current week (monday), if you search window is more than 10 days. is that ok?

0 Karma

Zakary_n
Path Finder

Well after some testing, it seems to be ok with my search. Each Monday has different totals, and current monday has smaller totals than last week's monday, so seems good I think. Thank you for your comment still!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...