Splunk Search

show last week values Mon-Sun and NOT Sun-Sat using earliest and latest

HattrickNZ
Motivator

How do I use earliest and latest to show last week Mon - Sun inclusive.

I have tried this earliest=-1w@w latest = @w but this is giving me Sun to Sat inclusive.

I would like to do it using this type of method earliest=-1w@w latest = @w

Tags (3)
0 Karma

MuS
Legend

Hi HattrickNZ,

you can use something like this instead:

w0 = Sunday w1 = Monday etc...

example: earliest=@w0 
 Searches from the current time to the previous Sun

Hope that helps ...

cheers, MuS

HattrickNZ
Motivator

tks jsut confirming that

earliest=-1w@w1 latest = @w1 will give me last week values for Mon - Sun

hmm, I can't seem to upload a picture file.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...