Splunk Search

To find the day for include/exclude weekends in search

smanojkumar
Communicator

Hi There!

   I would like to include/exclude weekend in the search, So i had created the dropdown for that, I'm getting error in the searches,

My Time format is 
2023-10-15T13:11:20.000+05:30

My dropdown is

<input type="radio" token="weekends" searchWhenChanged="true">
<label>Weekends</label>
<choice value="NOT (day_of_week=&quot;saturday&quot; OR day_of_week=&quot;sunday&quot;)">Exclude Weekends</choice>
<choice value="day_of_week=&quot;*&quot;">Include Weekends</choice>
<default>NOT (day_of_week="saturday" OR day_of_week="sunday")</default>
<initialValue>NOT (day_of_week="saturday" OR day_of_week="sunday")</initialValue>
</input>

My search is

`compliance("`console`", now(), -15d@d, mcafee,*, virus_, *, *, *)`

| eval day_of_week = lower(strftime(_time,"%A"))
| where NOT (day_of_week="saturday" OR day_of_week="sunday")
| chart count by virus_global
| sort virus_global

Thanks!

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Your filter to include weekends is "day_of_week=&quot;*&quot;". The asterisk as wildcard doesn't work with "where" command. So either change your search to replace "where" with "search" OR change your include weekend filter.

Either Change search to:

`compliance("`console`", now(), -15d@d, mcafee,*, virus_, *, *, *)`
| eval day_of_week = lower(strftime(_time,"%A"))
| search NOT (day_of_week="saturday" OR day_of_week="sunday")
| chart count by virus_global
| sort virus_global

 

OR change radio button to:

<input type="radio" token="weekends" searchWhenChanged="true">
  <label>Weekends</label>
  <choice value="NOT (day_of_week=&quot;saturday&quot; OR day_of_week=&quot;sunday&quot;)">Exclude Weekends</choice>
  <choice value="true()">Include Weekends</choice>
  <default>NOT (day_of_week="saturday" OR day_of_week="sunday")</default>
  <initialValue>NOT (day_of_week="saturday" OR day_of_week="sunday"). 
  </initialValue>
</input>

 

View solution in original post

somesoni2
Revered Legend

Your filter to include weekends is "day_of_week=&quot;*&quot;". The asterisk as wildcard doesn't work with "where" command. So either change your search to replace "where" with "search" OR change your include weekend filter.

Either Change search to:

`compliance("`console`", now(), -15d@d, mcafee,*, virus_, *, *, *)`
| eval day_of_week = lower(strftime(_time,"%A"))
| search NOT (day_of_week="saturday" OR day_of_week="sunday")
| chart count by virus_global
| sort virus_global

 

OR change radio button to:

<input type="radio" token="weekends" searchWhenChanged="true">
  <label>Weekends</label>
  <choice value="NOT (day_of_week=&quot;saturday&quot; OR day_of_week=&quot;sunday&quot;)">Exclude Weekends</choice>
  <choice value="true()">Include Weekends</choice>
  <default>NOT (day_of_week="saturday" OR day_of_week="sunday")</default>
  <initialValue>NOT (day_of_week="saturday" OR day_of_week="sunday"). 
  </initialValue>
</input>

 

smanojkumar
Communicator

Hi @somesoni2 ,
   Thanks for your response!

   It works, Also is that possible to change the time range picker value as a token based on some conditions

If present day is "Monday" and if user selects the option "Exclude weekend", the time range picker should looks for the data on friday
If user selects the option "Include weekend", the time range picker should be yesterday

Thanks in Advance!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...