How to change a span of 1 week time to start from Monday to friday

[syedabuthahir]

How to change a span of 1 week time to start from Monday to friday

usually span=1w it will show data from monday 00:00 hrs to Sunday 23.59 hrs

Can someone help on this query 

Thanks in Advance

[syedabuthahir]

@yuanliu  can i have the search query

[yuanliu]

This is an example. My data comes in once a week on Sunday.  But sometimes it comes late by a day or two.  I want to plot data by week:

| eval _time = _time + 5 * 86400
| timechart span=1w@w count

 Here, positive or negative offset is chosen based on how I want to date label to show on the time axis.

[aasabatini]

Hi @syedabuthahir  

try this:

 sourcetype=foo
| eval date_hour=strftime(_time, "%H") | eval date_wday = strftime(_time, "%w")
| search date_hour>=0 date_hour<=23 date_wday>=1 date_wday<=5

[yuanliu]

When I need to fudge week, I add or subtract days from _time.