Splunk Search

How to Search a certain Time Range based on the Current Day of the week

anholzer
Explorer

I am attempting to create a search that returns data for a different time-range based on the current day of the week. Desired output would be returning the data from last sunday-saturday (last week) if today is a Sunday or a Monday, and if today is any day of the week other than Sun/Mon then return the data from the current week to date. I have tried a couple of searches so far and am not having success. Currently what I am working with is this:

| eval weekday=strftime(now(),"%A")
| eval early=case(weekday=Monday, -w@w+1d, NOT weekday=Monday, @w0+1d)
| table early

used as a sub-search for the "earliest=xx" command within the larger query.

Can anyone assist?

Tags (1)
0 Karma

dmarling
Builder

This should do the trick. Just put this subsearch at the very beginning of your top line. It will make it so if today is currently Monday or Sunday it will set your earliest to last Sunday at Midnight and latest to the current Sunday at midnight and if it's not Sunday or Monday it will set your earliest to Sunday at midnight and your latest to now:

[| makeresults count=1 
    | eval earliest=if(strftime(now(), "%A")="Monday" OR strftime(now(), "%A")="Sunday", relative_time(now(), "-1w@w"), relative_time(now(), "@w")) 
    | eval latest=if(strftime(now(), "%A")="Monday" OR strftime(now(), "%A")="Sunday", relative_time(now(), "@w"), "now") 
    | eval search="earliest=".earliest." latest=".latest 
    | fields search]
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

kmaron
Motivator

This isn't going to give you the subsearch you were looking for but I believe it can solve your issue.

[base search] earliest=-14d@d
| eval last_week_start_time=relative_time(now(),"-7d@w0")
| eval this_week_start_time=relative_time(now(),"@w0+1d")
| eval last_week_end_time=relative_time(now(),"@w0")
| eval this_week_end_time=relative_time(now(),"now")
| eval weekday=strftime(now(),"%A")
| eval start_time=if((weekday="Monday" OR weekday="Sunnday"),last_week_start_time,this_week_start_time)
| eval end_time=if((weekday="Monday" OR weekday="Sunnday"),last_week_end_time,this_week_end_time)
| where _time>=start_time AND _time<=end_time
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...