Splunk Search

how to search data created before last 14 Business days?

wangzhaoyu
New Member

I have a set of data with "submit date" like "2019-Jan-16 17:42:00". How can I get data submitted before 14 Business days? Thanks!

Tags (2)
0 Karma

mayurr98
Super Champion

Hi Try this simple query

index=your_index latest=-14d@d earliest=0 NOT (date_wday=saturday OR date_wday=sunday)

let me know if this helps!

0 Karma

dkeck
Influencer

HI,

do you want all data older than 14 days , or the data that came in on the 14th day before today?

0 Karma

wangzhaoyu
New Member

Hi,

I want the number of all data older than 14 Business days. thanks!

0 Karma

dkeck
Influencer

try index=your_index latest=-14d@d earliest=0 | stats count

for a simple count

0 Karma

wangzhaoyu
New Member

Does "latest=-14d@d" mean last Business days? or last natural days? thanks!

0 Karma
Get Updates on the Splunk Community!

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...