Getting Data In

Calculate weekdays assuming Saturday as 1/2 day

changux
Builder

Hi.
I want to calculate the weekdays in a month, using this:

| gentimes start=11/01/16 end=11/31/16 | search starthuman!="Sun*" starthuman!="Sat*" | stats count

My problem is that i need to count the saturdays as 1/2 day, for example: Without Sat/Sun, July has 21 weekdays. July has 4 saturdays, so i must add 0.5 * 4, then, the total count is 23. How i can do this?

Any help please?

Thanks!

0 Karma
1 Solution

sundareshr
Legend

Try this

| gentimes start=11/01/16 end=11/31/16 | eval dow=strftime(starttime, "%w")  | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

*UPDATED*

| makeresults | eval start=relative_time(now(), "@mon") | eval end=relative_time(now(), "+1mon@mon-1d") | eval mon=mvrange(start, end, "1d") | mvexpand mon | eval dow=strftime(mon, "%-w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

View solution in original post

sundareshr
Legend

Try this

| gentimes start=11/01/16 end=11/31/16 | eval dow=strftime(starttime, "%w")  | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

*UPDATED*

| makeresults | eval start=relative_time(now(), "@mon") | eval end=relative_time(now(), "+1mon@mon-1d") | eval mon=mvrange(start, end, "1d") | mvexpand mon | eval dow=strftime(mon, "%-w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)

changux
Builder

Awesome! Some way to do to the current month and delete start/end dates?

0 Karma

sundareshr
Legend

Try updated answer

0 Karma

changux
Builder

Last question: i created a search macro with this and when i ran, splunk returns:

Error in 'makeresults' command: This
command must be the first command of a
search.

Any idea?

0 Karma

PPape
Contributor

can you show us where you use the macro?

0 Karma

changux
Builder

After created, i try to call in the search bar: workdayswithsat

With ` begin/end

0 Karma

sundareshr
Legend

You probably don't need |makeresults. Try without it.

0 Karma

PPape
Contributor

This should work

| gentimes start=11/01/16 end=11/31/16  | search starthuman!="Sun*" |rex field=starthuman "^(?<day>\C{3}).*" | eval daycount = if(day=="Sat",0.5,1) | stats sum(daycount)

changux
Builder

Awesome! Some way to do to the current month and delete start/end dates?

0 Karma

PPape
Contributor

try @sundareshr updated answer 🙂 this is really great

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...