Getting Data In

Calculate weekdays assuming Saturday as 1/2 day

changux
Builder

Hi.
I want to calculate the weekdays in a month, using this:

| gentimes start=11/01/16 end=11/31/16 | search starthuman!="Sun*" starthuman!="Sat*" | stats count

My problem is that i need to count the saturdays as 1/2 day, for example: Without Sat/Sun, July has 21 weekdays. July has 4 saturdays, so i must add 0.5 * 4, then, the total count is 23. How i can do this?

Any help please?

Thanks!

0 Karma
1 Solution

sundareshr
Legend

Try this

| gentimes start=11/01/16 end=11/31/16 | eval dow=strftime(starttime, "%w")  | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

*UPDATED*

| makeresults | eval start=relative_time(now(), "@mon") | eval end=relative_time(now(), "+1mon@mon-1d") | eval mon=mvrange(start, end, "1d") | mvexpand mon | eval dow=strftime(mon, "%-w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

View solution in original post

sundareshr
Legend

Try this

| gentimes start=11/01/16 end=11/31/16 | eval dow=strftime(starttime, "%w")  | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

*UPDATED*

| makeresults | eval start=relative_time(now(), "@mon") | eval end=relative_time(now(), "+1mon@mon-1d") | eval mon=mvrange(start, end, "1d") | mvexpand mon | eval dow=strftime(mon, "%-w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

changux
Builder

Awesome! Some way to do to the current month and delete start/end dates?

0 Karma

sundareshr
Legend

Try updated answer

0 Karma

changux
Builder

Last question: i created a search macro with this and when i ran, splunk returns:

Error in 'makeresults' command: This
command must be the first command of a
search.

Any idea?

0 Karma

PPape
Contributor

can you show us where you use the macro?

0 Karma

changux
Builder

After created, i try to call in the search bar: workdayswithsat

With ` begin/end

0 Karma

sundareshr
Legend

You probably don't need |makeresults. Try without it.

0 Karma

PPape
Contributor

This should work

| gentimes start=11/01/16 end=11/31/16  | search starthuman!="Sun*" |rex field=starthuman "^(?<day>\C{3}).*" | eval daycount = if(day=="Sat",0.5,1) | stats sum(daycount)

changux
Builder

Awesome! Some way to do to the current month and delete start/end dates?

0 Karma

PPape
Contributor

try @sundareshr updated answer 🙂 this is really great

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...