Splunk Search

Previous business / week day

MBerikcurtis
Path Finder

Could you tell me if Splunk has a way of filtering based on previous business day or previous weekday? I’m using earliest=-1d@d latest=@d to get results from the previous day but that doesn’t help me on Mondays.

Tags (2)
1 Solution

Drainy
Champion

@w0 as the earliest will snap to the Sunday of the current week, @w0+1d would snap to the Monday of the week you are currently on.
-w@w+1d would snap to the Monday of the previous business week.
@w5 would snap to the closest Friday.

Below is some detail on SearchTimeModifiers:
http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/SearchTimeModifiers

View solution in original post

MBerikcurtis
Path Finder

This solution was sent to me by Lincoln at Splunk:

sourcetype="*Security" earliest=-3d@d latest=@d 
| eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") 
| eventstats max(day_value) as high_value 
| where day_value=high_value
| eventstats count as "EventCount" by EventCode 
| table EventCode EventCodeDescription EventCount 
| sort EventCode 
| dedup EventCode

earliest=-3d@d latest=@d = We always have to go back 3 days to pick up Friday when it's Monday.

eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") = Splunk stores the day of the week (in lowercase) as a meta field for every event. Here, we're just setting numeric values into a field called day_value which allows us to differentiate and ultimately code events from the previous business day. Saturday and Sunday are given values of zero. We need decrementing values for the other days of the week, so we can distinguish the previous day from the two days prior. This was the hardest part for me to figure out. Took a little extra "noodle power." 🙂

eventstats max(day_value) as high_value = The max function of eventstats determines the largest value inserted into the day_value field by the case function above and puts this value into a new field called high_value. If you run the search on Monday, the max value would be 5 which is contained in Friday's events. Remember, eventstats will code every event (including Saturday and Sunday's events with this value in the high_value field).

where day_value=high_value = Now, all that's left is to filter out the events that have lower values in the day_value field and we do that easily enough with the where command.

Drainy
Champion

@w0 as the earliest will snap to the Sunday of the current week, @w0+1d would snap to the Monday of the week you are currently on.
-w@w+1d would snap to the Monday of the previous business week.
@w5 would snap to the closest Friday.

Below is some detail on SearchTimeModifiers:
http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/SearchTimeModifiers

Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...