Splunk Search

How to create a search showing data starting on a Saturday up to current day

SteveBowser
Explorer

I have a customer that needs to have a dashboard showing a start date of Saturday and ending on the current workday. The search that I have tried, with no results, is:

index=| eval today=strftime(now(),"%a")
| eval Backdays=case(today=="Mon",2,today=="Tue",3,today=="Wed",4,today=="Thur",5,today=="Fri",6)
| search earliest=-"Backdays"d@d latest=now

There is definitely data for this past Saturday, Sunday and today (Monday) and the "Backdays" field is populating with a 1 (in this case)

Any help is most appreciated.

Thank you.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk can do that for you. Use earliest_time to say you want the beginning of the current week minus one day.

index=foo earliest_time=@w-1d
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Splunk can do that for you. Use earliest_time to say you want the beginning of the current week minus one day.

index=foo earliest_time=@w-1d
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SteveBowser
Explorer

Yes, I like your answer better than mine. Thank you for the quick response

0 Karma

SteveBowser
Explorer

I'll answer my own question -
earliest=@w6 latest=now

No need for the evals.

Have a great day!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!