how to take only monday data for a month

[dtccsundar]

Hi,

My requirement is to take each week monday data alone for a month in trending chart .

This need to be showed for status field ,which will have ( pass,fail,error,deleted) values in it.The individual count of  status to be shown for each week monday for a month.

Please let me know how to do this .

[gcusello]

Hi @dtccsundar,

did you already tried to insert in your main search:

date_wday="monday"

?

Ciao.

Giuseppe

[dtccsundar]

Thank you .

Yes tried with earliest=-30d@w1 latest=-d@w1 in my search , but i couldnt get the desired o/p.

I am not seeing the field date_wday in my events , since i am using a sql view as source.How this can be achieved in this case.

[gcusello]

Hi @dtccsundar,

please try something like this:

earliest=-30d@d latest=-d@d date_wday="monday"

Ciao.

Giuseppe

[dtccsundar]

Thank you .

I am getting no results for this .

I have _time field in my events . Is is possible to derive each monday from that ?

[gcusello · Accepted solution]

Hi @dtccsundar,

date_wday is a default field in Splunk, if you haven't you can extract it in this way from _time:

<your_search>
| eval date_wday=strftime(_time,"%A")
| search date_wday!="Monday"

Ciao.

Giuseppe

[dtccsundar]

Thank you. This worked Perfectly !!

[gcusello]

Hi @dtccsundar,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[dtccsundar]

Hi Giuseppe,

Can you please help me in the below drill down please ,

Need help for the below, The sourcetypes has different values in it like below,

 index=a sourcetype=b |eval details= ONE |

append [|search index=c sourcetype=d|eval details=TWO] |

append [|search index=e sourcetype=f|eval details=THREE]

|eventstats count by details| Pass%=count(pass)/total*100,2 Fail%=count(fail)/total*100,2 Error%=count(Error)/total*100,2 |table pass fail error total

I have a barchart with x-axis with details and y-axis %(pass%,fail%,error%) of ( pass fail error etc).

When i click the details(x-axis) in barchart , the trending should show number of individual Pass,fail,error based on the details values selected .

The click values should be passed to the the trending .Please let me know how it can be achieved .