Set earliest and latest using a variable depending on the current day

[sweetlile]

Hey,
I want to display the results on a table. it works depending on the timeRange picker when I want it to display results depending on my eval function!!
This is my search:

source="##" RC="*"  SN="*" [search source="##" | head 1 | eval earliest=if(date_wday="monday", "-3d@d-4h", "-1d@d-4h") | eval latest=if(date_wday="monday", "@d-4h", "@d-4h") | table earliest, latest | format "" "" "" "" "" ""] | chart count by  RC, SN

It doesn't work when It's Monday, I want the search from Friday at 8AM until Monday at 8AM and If it's another day, I want the search results to be from the -d at 8AM until the current day at 8AM.
Can you help me, Please?

[somesoni2]

Try like this. This will change the earliest and latest (time range) based on today.

 source="##" RC="*"  SN="*" [| gentimes start=-1 | eval earliest=if(lower(strftime(now(),"%A"))="monday", "-3d@d-4h", "-1d@d-4h") | eval latest="@d-4h" | table earliest, latest | format "" "" "" "" "" ""] | chart count by  RC, SN

[sweetlile]

Sorry it doen't work I don't know why,
this is what I used as a solution:

source="##" RC="*"  SN="*" [search source="##" | head 1 | eval date_wday = strftime(_time, "%A") |eval earliest=if(date_wday="Monday", "-3d@d+8h", "-1d@d+8h") | eval latest=if(date_wday="Monday", "@d+8h", "@d+8h") | table earliest, latest | format "" "" "" "" "" ""] | chart count over RC by SN

[somesoni2]

I can see you've changed the earliest and latest calculation, from the one mentioned in the question. Give this a try now..

source="##" RC="*"  SN="*" [| gentimes start=-1 | eval earliest=if(lower(strftime(now(),"%A"))="monday", "-3d@d+8h", "-1d@d+8h") | eval latest=if(lower(strftime(now(),"%A"))="monday",  "@d+8h", "@d+8h")   | table earliest, latest | format "" "" "" "" "" ""] | chart count by  RC, SN