Splunk Search

Previous business / week day

Path Finder

Could you tell me if Splunk has a way of filtering based on previous business day or previous weekday? I’m using earliest=-1d@d latest=@d to get results from the previous day but that doesn’t help me on Mondays.

Tags (2)
1 Solution

Champion

@w0 as the earliest will snap to the Sunday of the current week, @w0+1d would snap to the Monday of the week you are currently on.
-w@w+1d would snap to the Monday of the previous business week.
@w5 would snap to the closest Friday.

Below is some detail on SearchTimeModifiers:
http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/SearchTimeModifiers

View solution in original post

Path Finder

This solution was sent to me by Lincoln at Splunk:

sourcetype="*Security" earliest=-3d@d latest=@d 
| eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") 
| eventstats max(day_value) as high_value 
| where day_value=high_value
| eventstats count as "EventCount" by EventCode 
| table EventCode EventCodeDescription EventCount 
| sort EventCode 
| dedup EventCode

earliest=-3d@d latest=@d = We always have to go back 3 days to pick up Friday when it's Monday.

eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") = Splunk stores the day of the week (in lowercase) as a meta field for every event. Here, we're just setting numeric values into a field called day_value which allows us to differentiate and ultimately code events from the previous business day. Saturday and Sunday are given values of zero. We need decrementing values for the other days of the week, so we can distinguish the previous day from the two days prior. This was the hardest part for me to figure out. Took a little extra "noodle power." 🙂

eventstats max(day_value) as high_value = The max function of eventstats determines the largest value inserted into the day_value field by the case function above and puts this value into a new field called high_value. If you run the search on Monday, the max value would be 5 which is contained in Friday's events. Remember, eventstats will code every event (including Saturday and Sunday's events with this value in the high_value field).

where day_value=high_value = Now, all that's left is to filter out the events that have lower values in the day_value field and we do that easily enough with the where command.

Champion

@w0 as the earliest will snap to the Sunday of the current week, @w0+1d would snap to the Monday of the week you are currently on.
-w@w+1d would snap to the Monday of the previous business week.
@w5 would snap to the closest Friday.

Below is some detail on SearchTimeModifiers:
http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/SearchTimeModifiers

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!