In a perfect world I'd find a way to get this into the time picker, but I haven't seen suggestions for that (please warn me if I've missed something). Q:  Is the solution I've found for dealing with previous business       day workable or have I missed an edge case that people have      seen before (e.g., it blows up in cron)? Thanks I'm trying to find some way to evaluate a window time during a business week. Goal is having a dashboard w/ drilldown to the previous business day (for comparison to the main graph giving today's data). This means processing last Friday on Monday. The basic question has been asked any number of times but the answers vary in complexity. The simplest approach I could find was using a 3-day window in the time picker and then adding an earliest/latest value via sub-select to limit the data: https://community.splunk.com/t5/Splunk-Search/How-to-to-dynamically-change-earliest-amp-latest-in-subsearch-to/m-p/631220 The approach of: <your index search> [ search index=summary source="summaryName" sourcetype=stash search_name="summaryName field1=* | stats count by _time | streamstats window=2 range(_time) as interval | where interval > 60 * 15 | eval earliest=_time-interval+900, latest=_time | fields earliest latest ] Seems simple enough: Generate an earliest/latest based on the weekday. Applying this to my specific case of business hours during the business week I get this with a case on the weekday from makeresults, which at least seems like a lightweight solution: index="foo" [ | makeresults | eval wkday = strftime( _time, "%a" ) | eval earliest = case( wkday = "Mon", "-3d@d+8h", wkday = "Sun", "-2d@d+8h", wkday = "Sat", "-1d@d+8h", 1=1, "@d+8h" ) | eval latest = case( wkday = "Mon", "-3d@d+17h", wkday = "Sun", "-2d@d+17h", wkday = "Sat", "-1d@d+17h", 1=1, "@d+17h" ) | fields earliest latest ] | stats earliest( _time ) as prior latest( _time ) as after | eval prior = strftime( prior, "%Y.%m.%d %H:%M:%S" ) | eval after = strftime( after, "%Y.%m.%d %H:%M:%S" ) | table prior after And even seems to work: on Sunday the 17th I get: prior                                    after 2024.03.15 08:00:00 2024.03.15 16:59:59 Only question now is whether there is some edge case I've missed (e.g., running via crontab) where the makeresults will generate an offball time or something. Thanks ... View more

Q: Given a "timechart span=1m sep='-" last(foo) as foo last( bar) as bar by  hostname", how would I get a unique value of the bar-* fields? This has to be a standard problem, but I cannot find any writeup of solving it... Background: I'm processing Apache Impala logs for data specific to a query, server, and pool (i.e., cluster). The data arrives on multiple lines that are easily combined with a transaction and rex-ed out to get the values. Ignoring the per-query values, I end up with: | fields _time hostname reserved max_mem The next step is to summarize the reserved and max_mem by minute, taking the last value by hostname and summing the reserved values, extracting a single max_mem value. I can get the data by host using: | timechart span=1m sep="-" last( reserved ) as reserved last( max_mem ) as max_mem by hostname which gives me a set of reserved-* and max_mem-* fields. The reserved values can be summed with: | addtotals fieldname=reserved reserved-* Issue: The problem I'm having is getting the single unique value of max_mem back out of it. The syntax "| stats values( max_mem-* ) as max_mem" does not work, but gives the idea of what I'm trying to accomplish. I've tried variations on bin to group the values with stats to post-process them, but gotten nowhere. I get the funny feeling that there may be a way to "| addcols [ values( max_mem-* ) as max_mem " but that doesn't get me anywhere either. A slightly different approach would be leaving the individual reserved values as-is, finding some way to get the single max_mem value out of the timechart, and plotting it as an area chart using max_mem as a layover  (i.e., the addtotals can be skipped). In either case, I'm still stuck getting the unique value from max_mem-* as a single field for propagation with the reserved values. Aside: The input to this report is taken from the transaction list which includes memory estimates and SQL statements per query. I need that much for other purposes. The summary here of last reserved & max_mem per time unit is taken from the per-query events because the are the one place that the numbers are available. ... View more