Splunk Search

How to have exclude weekend in the splunk dashboard as a input button?

peterfox1992
Explorer

Hi Folks,

I have been working on a dashboard that displays result as a timechart grouping by days.

I see results are displayed for the dates I have chosen. My requirement here is to not to have weekend data on the dashboard. which I have achieved that by adding the below in the search query.

| eval date_wday=lower(strftime(_time,"%A")) |where NOT (date_wday="saturday" OR date_wday="sunday") | fields - date_wday

But my question here is how I can achieve this dynamically? Instead of adding this in the query, I should have input button in dashboard which should be used to select 'weekend data needed' or 'not needed' and accordingly result should be populated in Dashboard.

Can someone advise on this? Much appreciate for the suggestions provided.

Thanks.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="weekends" id="weekends">
      <label>$weekends$</label>
      <choice value="|where NOT (date_wday=&quot;saturday&quot; OR date_wday=&quot;sunday&quot;)">Weekend only</choice>
    </input>
| eval date_wday=lower(strftime(_time,"%A")) $weekends$ | fields - date_wday
0 Karma

peterfox1992
Explorer

Thanks for the reply @ITWhisperer .

I have added this in my source code but what I noticed is all panels are waiting for the user input. Once I click on Weekend Only check box, the data got populated only for MON-FRI.

Actually what I was looking for is,

When I open the dashboard, it should not be waiting for user input and each panels should be populated along with Weekend data as well and on the top I should have a Check box as 'Exclude Weekend'. Once I click this checkbox, all the panels should reload without weekend data.

This is my current input source which I'm using.

<fieldset autoRun="true" submitButton="false">
<input type="time" token="field2">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="group" searchWhenChanged="true">
<label>Group By</label>
<choice value="1mon">Month</choice>
<choice value="1w">Week</choice>
<choice value="1d">Day</choice>
<choice value="1h">Hour</choice>
<default>1d</default>
</input>
</fieldset>

Kindly need suggestion. Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...