Splunk Search

on day-2 of every year which will generate a CSV having the number of days in each month excluding weekends.

dmacgillivray
Communicator

Hello Splunk,

I am Trying to write an eval statement that would allow a development team push data to a csv that contains
the number of days in each month excluding weekends. I am hoping to do this without using unix scripting and
purely with Splunk SPL

Just want to do schedule this to go to a csv perhaps as many as ten years in advance? Does anyone know
of an easy eval statement that would go to a lookup?

Thanks,
Daniel MacGillivray

Tags (3)
0 Karma

dmacgillivray
Communicator

Thanks Vganjare. That is superb ! Who knew. Splunk can cover every possibility. It is like someone invented ANSI sql all over again !!

0 Karma

vganjare
Builder

Hi,

You can use *gentimes * command. Following is sample search query:

|gentimes start=-40 end=+100|fields starttime|eval date=strftime(starttime,"%m-%d-%Y")|eval day=strftime(starttime,"%A")|eval mon=strftime(starttime,"%m")|eval month=strftime(starttime,"%b")|eval year=strftime(starttime,"%Y")|fields date,day,month,mon,year | eval holiday=if(day=="Sunday" or day=="Saturday", "Yes", "No") | where holiday="No" | stats count by mon,year

Change the gentimes start and end as per your need.

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...