Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to exclude weekends from last 30 days search ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My query essentially goes thru every event and picks a field with response_time. And then calculates the average value of it.
I need to do this search for last 30 days excluding weekends(saturday,sunday). But in the presets I don't see any option to exclude weekend. Need help for that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Something like...
index=main date_wday!=saturday AND date_wday!=sunday
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Something like...
index=main date_wday!=saturday AND date_wday!=sunday
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @solarboyz1 , How can I have this as a customized input button ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You would need to create something like a checkbox on your form that says something like "Exclude Weekends" or "Week Days Only"
When that checkbox is selected, have it add the "date_wday!=saturday AND date_wday!=sunday" to your base search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@solarboyz1, Thanks for the reply.
Created input option like this. Working as expected but what I noticed is Tick mark is not changing when I select the other option; showing both buttons as Checked. Any suggestions ?
<input type="checkbox" token="weekends" id="weekends">
<label>Weekend Option</label>
<choice value="| where NOT (date_wday="saturday" OR date_wday="sunday")">Exclude Weekend</choice>
<choice value="">Include Weekend</choice>
<delimiter> </delimiter>
</input>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tick mark is not changing when I select the other option
I'm going to infer that you are using the timechart to visualize the data, and the timechart still has weekends on the x axis.
I believe You will need to switch from timechart to using chart over _time
Which should give you a chart without any weekends.
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
