Splunk Search

How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n
Path Finder

Hello, was looking at this topic :

https://answers.splunk.com/answers/112838/how-can-you-restrict-a-timechart-to-display-only-weekdays....

My problem is exactly the same. I want to remove Saturdays and Sundays from my timechart. However, it does not seem to work properly in my case, it seems it just ignores them without removing them.

Example below :

alt text

Is there a way to completely remove them from the X-Axis ?

| my base search
| timechart count(foo) as "foo", count(bar) as "bar" span=1d
| eval date_wday=lower(strftime(_time,"%A")) 
| where NOT (date_wday="saturday" OR date_wday="sunday")
| fields - date_wday
Tags (1)
0 Karma
1 Solution

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

View solution in original post

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

sambit_kabi
Path Finder

Lifesaver.  Excellent!! I still couldn't understand how is Splunk treating it differently 

0 Karma

Zakary_n
Path Finder

A problem I discovered with this request, if you guys got any idea.

I created a new question :

https://answers.splunk.com/answers/730248/chart-not-displaying-in-the-right-order.html?minQuestionBo...

0 Karma

Zakary_n
Path Finder

You sir made my day. Very nice workaround. Thank you.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

but the above search will add last week (monday) stats to current week (monday), if you search window is more than 10 days. is that ok?

0 Karma

Zakary_n
Path Finder

Well after some testing, it seems to be ok with my search. Each Monday has different totals, and current monday has smaller totals than last week's monday, so seems good I think. Thank you for your comment still!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...