Splunk Search

How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n
Path Finder

Hello, was looking at this topic :

https://answers.splunk.com/answers/112838/how-can-you-restrict-a-timechart-to-display-only-weekdays....

My problem is exactly the same. I want to remove Saturdays and Sundays from my timechart. However, it does not seem to work properly in my case, it seems it just ignores them without removing them.

Example below :

alt text

Is there a way to completely remove them from the X-Axis ?

| my base search
| timechart count(foo) as "foo", count(bar) as "bar" span=1d
| eval date_wday=lower(strftime(_time,"%A")) 
| where NOT (date_wday="saturday" OR date_wday="sunday")
| fields - date_wday
Tags (1)
0 Karma
1 Solution

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

View solution in original post

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

sambit_kabi
Path Finder

Lifesaver.  Excellent!! I still couldn't understand how is Splunk treating it differently 

0 Karma

Zakary_n
Path Finder

A problem I discovered with this request, if you guys got any idea.

I created a new question :

https://answers.splunk.com/answers/730248/chart-not-displaying-in-the-right-order.html?minQuestionBo...

0 Karma

Zakary_n
Path Finder

You sir made my day. Very nice workaround. Thank you.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

but the above search will add last week (monday) stats to current week (monday), if you search window is more than 10 days. is that ok?

0 Karma

Zakary_n
Path Finder

Well after some testing, it seems to be ok with my search. Each Monday has different totals, and current monday has smaller totals than last week's monday, so seems good I think. Thank you for your comment still!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>