Hi ,
We have a field called AGING which tells how many days a ticket exists.
In order to get the accurate age, we want to subtract weekends from the AGING field.
For example: If aging has value of 30 days, we need to exclude all Saturdays and Sundays from these 30 days and need to output the results.
Can you please help?
Thanks.
Try this
... | eval end=_time | eval start=end-(aging*86400)| eval range=mvrange(start, end, 86400) | convert ctime(range) timeformat="%+" | eval BusinessDays=mvcount(mvfilter(NOT match(range,"(Sun|Sat).*")))
Brilliant; I learned mvrange
today!