All Apps and Add-ons

Can timewrap be utilized to only use weekdays?

aferone
Builder

Can timewrap be utilized to only use weekdays?

Specifically, if I am searching from a Monday for a daily report, can I skip Saturday and Sunday and use the timewrap utility to chart Friday? We want to be able to skip Saturdays and Sundays when we use the daily comparison of timewrap.

Thanks!

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could do something like this, run over -7d@d to @d+d in my case:

| tstats prestats=t count where index=_internal by _time span=1h | timechart span=1h count
| eval wday = strftime(_time, "%a") | where wday != "Sat" AND wday != "Sun" | fields - wday
| timewrap d

The first line loads an example timechart, the second throws out Saturdays and Sundays, and finally it runs timewrap. I get a chart for latest_day, 1day_before, 2days_before, 5days_before, 6days_before, 7days_before - note how 3 and 4 days before are missing, those would be Saturday and Sunday.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could do something like this, run over -7d@d to @d+d in my case:

| tstats prestats=t count where index=_internal by _time span=1h | timechart span=1h count
| eval wday = strftime(_time, "%a") | where wday != "Sat" AND wday != "Sun" | fields - wday
| timewrap d

The first line loads an example timechart, the second throws out Saturdays and Sundays, and finally it runs timewrap. I get a chart for latest_day, 1day_before, 2days_before, 5days_before, 6days_before, 7days_before - note how 3 and 4 days before are missing, those would be Saturday and Sunday.

aferone
Builder

Perfect! Thank you!!

0 Karma

aferone
Builder

Yes, however, I want to skip Saturday's and Sunday's. I wasn't sure if that could be done utilizing Timewrap.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

So... you are doing a "compare today with the last X working days" report?

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...