Hi,
How do I get the stats for the last week/month for different time frames based on the day of the week?
Monday to Saturday 10:00 AM - 9:00 PM
Sunday 12:00 PM - 8:00 PM
Thanks.
You should be able to do this with a 'where' clause and the date_wday/date_hour fields like this:
search sourcetype=bob | where (date_hour>=10 AND date_hour<21 AND date_wday!="sunday") OR (date_hour>=12 AND date_hour<20 AND date_wday=="sunday")
Try something like this
If date_hour and date_wday fields are available in your events
index=foo sourcetype=bar (date_wday=sunday AND date_hour>=12 date_hour<20 ) OR (date_wday!=sunday AND date_hour>=10 date_hour<21 )
If they are not
index=foo sourcetype=bar | eval date_wday=lower(strftime(_time,"%A")) | eval date_hour=tonumber(strftime(_time,"%H")) | where (date_wday=sunday AND date_hour>=12 date_hour<20 ) OR (date_wday!=sunday AND date_hour>=10 date_hour<21 )
I've date_hour and date_wday fields. Thanks for your time.
You should be able to do this with a 'where' clause and the date_wday/date_hour fields like this:
search sourcetype=bob | where (date_hour>=10 AND date_hour<21 AND date_wday!="sunday") OR (date_hour>=12 AND date_hour<20 AND date_wday=="sunday")
Thanks that worked:)