Splunk Search

How to exclude weekends from last 30 days search ?

zacksoft
Contributor

My query essentially goes thru every event and picks a field with response_time. And then calculates the average value of it.
I need to do this search for last 30 days excluding weekends(saturday,sunday). But in the presets I don't see any option to exclude weekend. Need help for that.

Tags (1)
0 Karma
1 Solution

solarboyz1
Builder

Something like...
index=main date_wday!=saturday AND date_wday!=sunday

View solution in original post

solarboyz1
Builder

Something like...
index=main date_wday!=saturday AND date_wday!=sunday

peterfox1992
Explorer

Hi @solarboyz1 , How can I have this as a customized input button ?

 

0 Karma

solarboyz1
Builder

You would need to create something like a checkbox on your form that says something like "Exclude Weekends" or "Week Days Only"

When that checkbox is selected, have it add the "date_wday!=saturday AND date_wday!=sunday"  to your base search. 

 

 

 

0 Karma

peterfox1992
Explorer

@solarboyz1, Thanks for the reply.

Created input option like this. Working as expected but what I noticed is Tick mark is not changing when I select the other option; showing both buttons as Checked.  Any suggestions ?

<input type="checkbox" token="weekends" id="weekends">
<label>Weekend Option</label>
<choice value="| where NOT (date_wday=&quot;saturday&quot; OR date_wday=&quot;sunday&quot;)">Exclude Weekend</choice>
<choice value="">Include Weekend</choice>
<delimiter> </delimiter>
</input>

 

0 Karma

solarboyz1
Builder

Tick mark is not changing when I select the other option

 

I'm going to infer that you are using the timechart to visualize the data, and the timechart still has weekends on the x axis.

I believe You will need to switch from timechart  to  using chart over _time 

Which should give you a chart without any weekends. 

 

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...