How to Search a certain Time Range based on the Current Day of the week

[anholzer]

I am attempting to create a search that returns data for a different time-range based on the current day of the week. Desired output would be returning the data from last sunday-saturday (last week) if today is a Sunday or a Monday, and if today is any day of the week other than Sun/Mon then return the data from the current week to date. I have tried a couple of searches so far and am not having success. Currently what I am working with is this:

| eval weekday=strftime(now(),"%A")
| eval early=case(weekday=Monday, -w@w+1d, NOT weekday=Monday, @w0+1d)
| table early

used as a sub-search for the "earliest=xx" command within the larger query.

Can anyone assist?

[dmarling]

This should do the trick. Just put this subsearch at the very beginning of your top line. It will make it so if today is currently Monday or Sunday it will set your earliest to last Sunday at Midnight and latest to the current Sunday at midnight and if it's not Sunday or Monday it will set your earliest to Sunday at midnight and your latest to now:

[| makeresults count=1 
    | eval earliest=if(strftime(now(), "%A")="Monday" OR strftime(now(), "%A")="Sunday", relative_time(now(), "-1w@w"), relative_time(now(), "@w")) 
    | eval latest=if(strftime(now(), "%A")="Monday" OR strftime(now(), "%A")="Sunday", relative_time(now(), "@w"), "now") 
    | eval search="earliest=".earliest." latest=".latest 
    | fields search]

[kmaron]

This isn't going to give you the subsearch you were looking for but I believe it can solve your issue.

[base search] earliest=-14d@d
| eval last_week_start_time=relative_time(now(),"-7d@w0")
| eval this_week_start_time=relative_time(now(),"@w0+1d")
| eval last_week_end_time=relative_time(now(),"@w0")
| eval this_week_end_time=relative_time(now(),"now")
| eval weekday=strftime(now(),"%A")
| eval start_time=if((weekday="Monday" OR weekday="Sunnday"),last_week_start_time,this_week_start_time)
| eval end_time=if((weekday="Monday" OR weekday="Sunnday"),last_week_end_time,this_week_end_time)
| where _time>=start_time AND _time<=end_time