syntax to look at data on Mondays only

[dang]

I'm attempting to write a splunk query which will report back the sum of events for each monday. For some reason when I use "date_wday=monday" I see events from both Sunday and Monday in my result sets (when looking back at the last 30 days).

an example of the search I'm doing is something like:

index="monitoring" "Database=Errors" Metric=ConnectionAttempt date_wday=Monday  | timechart span=1d sum(ConnectionAttempt) 

How can I get data back for Mondays only, without specifically enumerating the dates?

[wdhathaway]

There is a good collection around this at http://splunk-base.splunk.com/answers/4279/timezone-and-timestamp-modification-at-searchreport-time

[dang]

Thanks. I'm temporarily using the eval statement in my search until I can work this out in a more complete manner with our splunk admins.

[wdhathaway]

The date_wday=Monday syntax works for me. If you are getting back data from late Sunday night in your mix, then you might have a timezone specified incorrectly or getting assumed somewhere in the indexing/searching process that is causing the issue.

When you look at an event that has a logging time of Sunday, what day/time does Splunk say the event occurs at?

[dang]

You might be right about the timezone issue. The first datapoint I see is on Sunday at 5pm, and I'm in PDT. I'm not the admin of our splunk system, so I'll reach out to the folks who do administer this.

Is there a command to add a timezone offset to a search?