I have a customer that needs to have a dashboard showing a start date of Saturday and ending on the current workday. The search that I have tried, with no results, is:
index=| eval today=strftime(now(),"%a")
| eval Backdays=case(today=="Mon",2,today=="Tue",3,today=="Wed",4,today=="Thur",5,today=="Fri",6)
| search earliest=-"Backdays"d@d latest=now
There is definitely data for this past Saturday, Sunday and today (Monday) and the "Backdays" field is populating with a 1 (in this case)
Any help is most appreciated.
Splunk can do that for you. Use earliest_time to say you want the beginning of the current week minus one day.
View solution in original post
Yes, I like your answer better than mine. Thank you for the quick response
I'll answer my own question -
No need for the evals.
Have a great day!