Splunk Search

on day-2 of every year which will generate a CSV having the number of days in each month excluding weekends.

dmacgillivray
Communicator

Hello Splunk,

I am Trying to write an eval statement that would allow a development team push data to a csv that contains
the number of days in each month excluding weekends. I am hoping to do this without using unix scripting and
purely with Splunk SPL

Just want to do schedule this to go to a csv perhaps as many as ten years in advance? Does anyone know
of an easy eval statement that would go to a lookup?

Thanks,
Daniel MacGillivray

Tags (3)
0 Karma

dmacgillivray
Communicator

Thanks Vganjare. That is superb ! Who knew. Splunk can cover every possibility. It is like someone invented ANSI sql all over again !!

0 Karma

vganjare
Builder

Hi,

You can use *gentimes * command. Following is sample search query:

|gentimes start=-40 end=+100|fields starttime|eval date=strftime(starttime,"%m-%d-%Y")|eval day=strftime(starttime,"%A")|eval mon=strftime(starttime,"%m")|eval month=strftime(starttime,"%b")|eval year=strftime(starttime,"%Y")|fields date,day,month,mon,year | eval holiday=if(day=="Sunday" or day=="Saturday", "Yes", "No") | where holiday="No" | stats count by mon,year

Change the gentimes start and end as per your need.

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...