Splunk Search

how to search data created before last 14 Business days?

wangzhaoyu
New Member

I have a set of data with "submit date" like "2019-Jan-16 17:42:00". How can I get data submitted before 14 Business days? Thanks!

Tags (2)
0 Karma

mayurr98
Super Champion

Hi Try this simple query

index=your_index latest=-14d@d earliest=0 NOT (date_wday=saturday OR date_wday=sunday)

let me know if this helps!

0 Karma

dkeck
Influencer

HI,

do you want all data older than 14 days , or the data that came in on the 14th day before today?

0 Karma

wangzhaoyu
New Member

Hi,

I want the number of all data older than 14 Business days. thanks!

0 Karma

dkeck
Influencer

try index=your_index latest=-14d@d earliest=0 | stats count

for a simple count

0 Karma

wangzhaoyu
New Member

Does "latest=-14d@d" mean last Business days? or last natural days? thanks!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...