Previous business / week day

[MBerikcurtis]

Could you tell me if Splunk has a way of filtering based on previous business day or previous weekday? I’m using earliest=-1d@d latest=@d to get results from the previous day but that doesn’t help me on Mondays.

[MBerikcurtis]

This solution was sent to me by Lincoln at Splunk:

sourcetype="*Security" earliest=-3d@d latest=@d 
| eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") 
| eventstats max(day_value) as high_value 
| where day_value=high_value
| eventstats count as "EventCount" by EventCode 
| table EventCode EventCodeDescription EventCount 
| sort EventCode 
| dedup EventCode

earliest=-3d@d latest=@d = We always have to go back 3 days to pick up Friday when it's Monday.

eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") = Splunk stores the day of the week (in lowercase) as a meta field for every event. Here, we're just setting numeric values into a field called day_value which allows us to differentiate and ultimately code events from the previous business day. Saturday and Sunday are given values of zero. We need decrementing values for the other days of the week, so we can distinguish the previous day from the two days prior. This was the hardest part for me to figure out. Took a little extra "noodle power." 🙂

eventstats max(day_value) as high_value = The max function of eventstats determines the largest value inserted into the day_value field by the case function above and puts this value into a new field called high_value. If you run the search on Monday, the max value would be 5 which is contained in Friday's events. Remember, eventstats will code every event (including Saturday and Sunday's events with this value in the high_value field).

where day_value=high_value = Now, all that's left is to filter out the events that have lower values in the day_value field and we do that easily enough with the where command.

[Drainy · Accepted solution]

@w0 as the earliest will snap to the Sunday of the current week, @w0+1d would snap to the Monday of the week you are currently on.
-w@w+1d would snap to the Monday of the previous business week.
@w5 would snap to the closest Friday.

Below is some detail on SearchTimeModifiers:
http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/SearchTimeModifiers