Splunk Search

syntax to look at data on Mondays only

dang
Path Finder

I'm attempting to write a splunk query which will report back the sum of events for each monday. For some reason when I use "date_wday=monday" I see events from both Sunday and Monday in my result sets (when looking back at the last 30 days).

an example of the search I'm doing is something like:

index="monitoring" "Database=Errors" Metric=ConnectionAttempt date_wday=Monday  | timechart span=1d sum(ConnectionAttempt) 

How can I get data back for Mondays only, without specifically enumerating the dates?

Tags (1)
0 Karma

wdhathaway
Explorer
0 Karma

dang
Path Finder

Thanks. I'm temporarily using the eval statement in my search until I can work this out in a more complete manner with our splunk admins.

0 Karma

wdhathaway
Explorer

The date_wday=Monday syntax works for me. If you are getting back data from late Sunday night in your mix, then you might have a timezone specified incorrectly or getting assumed somewhere in the indexing/searching process that is causing the issue.

When you look at an event that has a logging time of Sunday, what day/time does Splunk say the event occurs at?

dang
Path Finder

You might be right about the timezone issue. The first datapoint I see is on Sunday at 5pm, and I'm in PDT. I'm not the admin of our splunk system, so I'll reach out to the folks who do administer this.

Is there a command to add a timezone offset to a search?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...