How to create a search showing data starting on a Saturday up to current day

[SteveBowser]

I have a customer that needs to have a dashboard showing a start date of Saturday and ending on the current workday. The search that I have tried, with no results, is:

index=| eval today=strftime(now(),"%a")
| eval Backdays=case(today=="Mon",2,today=="Tue",3,today=="Wed",4,today=="Thur",5,today=="Fri",6)
| search earliest=-"Backdays"d@d latest=now

There is definitely data for this past Saturday, Sunday and today (Monday) and the "Backdays" field is populating with a 1 (in this case)

Any help is most appreciated.

Thank you.

[richgalloway · Accepted solution]

Splunk can do that for you. Use earliest_time to say you want the beginning of the current week minus one day.

index=foo earliest_time=@w-1d

[SteveBowser]

Yes, I like your answer better than mine. Thank you for the quick response

[SteveBowser]

I'll answer my own question -
earliest=@w6 latest=now

No need for the evals.

Have a great day!