Splunk Search

Search bar previous week

mrovira
Engager

Hello,

I've around questions and answers but I cannot find the one I need.

I'm selecting previous week in the time range when searching, and Splunk is starting the week on Sunday. How or What I need to change to make it start the week on Monday for all the users?

I want to change it in the search bar, without making people to add earliest/latest or similar in the search.

I'm sure is something easy, but I cannot find it.

Thank you in advance!

Labels (1)
0 Karma
1 Solution

SOURAV_S
Explorer

Hi @mrovira,

Please check if this instruction works for you:

  1. Click on Settings
  2. Click on User Interface under 'Knowledge' sub-section.
  3. Click on Time Ranges
  4. Click on New Time Range on top right hand corner
  5. Since you want previous week Monday to be starting  point, configure your new time range as follows:
    1. Set earliest field as -5d@w1 (to denote previous Monday)
    2. Set latest field as @w6 (to denote Saturday, use @w5 for Friday)
  6. Make sure about your destination app.

These changes are available only for your user. To share it with everyone else, make sure you are admin and change the permissions. To configuring the time range to be available globally for all apps, and available for everyone to use and admins to modify: 

Settings > Time Ranges > your_custom_time_range_picker > Permissions

  1. Object should appear in All apps (system)
  2. Permissions: Read - Everyone, Write - admin

 

You're all done!

 

If this helps, mark this as solution.

Happy Splunking! 🙂

 
 

View solution in original post

SOURAV_S
Explorer

Hi @mrovira,

Please check if this instruction works for you:

  1. Click on Settings
  2. Click on User Interface under 'Knowledge' sub-section.
  3. Click on Time Ranges
  4. Click on New Time Range on top right hand corner
  5. Since you want previous week Monday to be starting  point, configure your new time range as follows:
    1. Set earliest field as -5d@w1 (to denote previous Monday)
    2. Set latest field as @w6 (to denote Saturday, use @w5 for Friday)
  6. Make sure about your destination app.

These changes are available only for your user. To share it with everyone else, make sure you are admin and change the permissions. To configuring the time range to be available globally for all apps, and available for everyone to use and admins to modify: 

Settings > Time Ranges > your_custom_time_range_picker > Permissions

  1. Object should appear in All apps (system)
  2. Permissions: Read - Everyone, Write - admin

 

You're all done!

 

If this helps, mark this as solution.

Happy Splunking! 🙂

 
 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Go to Settings->User interface->Time ranges and add a new time range defined as "-w@w1".

---
If this reply helps you, an upvote would be appreciated.

mrovira
Engager

Hello,

 

You both were right, but I just can mark one as the solution 😞  Even though I used what you both said.

Thank you for your reply and time, it helped me! 😊

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!