Splunk Search

How do you completely remove Saturdays and Sundays from displaying on a timechart?

Zakary_n
Path Finder

Hello, was looking at this topic :

https://answers.splunk.com/answers/112838/how-can-you-restrict-a-timechart-to-display-only-weekdays....

My problem is exactly the same. I want to remove Saturdays and Sundays from my timechart. However, it does not seem to work properly in my case, it seems it just ignores them without removing them.

Example below :

alt text

Is there a way to completely remove them from the X-Axis ?

| my base search
| timechart count(foo) as "foo", count(bar) as "bar" span=1d
| eval date_wday=lower(strftime(_time,"%A")) 
| where NOT (date_wday="saturday" OR date_wday="sunday")
| fields - date_wday
Tags (1)
0 Karma
1 Solution

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

View solution in original post

ashajambagi
Communicator

Try using this way ,if it helps

index="*"| eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a") |where NOT (date_wday = "sunday" OR date_wday = "saturday")|chart count by date_w

sambit_kabi
Path Finder

Lifesaver.  Excellent!! I still couldn't understand how is Splunk treating it differently 

0 Karma

Zakary_n
Path Finder

A problem I discovered with this request, if you guys got any idea.

I created a new question :

https://answers.splunk.com/answers/730248/chart-not-displaying-in-the-right-order.html?minQuestionBo...

0 Karma

Zakary_n
Path Finder

You sir made my day. Very nice workaround. Thank you.

0 Karma

lakshman239
Influencer

but the above search will add last week (monday) stats to current week (monday), if you search window is more than 10 days. is that ok?

0 Karma

Zakary_n
Path Finder

Well after some testing, it seems to be ok with my search. Each Monday has different totals, and current monday has smaller totals than last week's monday, so seems good I think. Thank you for your comment still!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...