A client would like a bunch of reports, written with -1w@w and @w week-snapping, to start on Monday morning instead of Sunday morning. Is it possible to change what @w snaps to?
Yes, you can use...
w0 = Sunday w1 = Monday etc...
example: earliest=@w0 Searches from the current time to the previous Sun
Yes, you can use...
w0 = Sunday w1 = Monday etc...
example: earliest=@w0 Searches from the current time to the previous Sun
Snippet from http://www.splunk.com/base/Documentation/4.1.4/User/ChangeTheTimeRangeOfYourSearch
Note: The abbreviations w0, w1, w2, w3, w4, w5 and w6 are reserved for specifying "snap to" days of the week; where w0 is Sunday, w1 is Monday, etc. When you snap to a week, @w or @week, it is equivalent to snapping to Sunday or @w0.
Note: When you specify @q, @qtr, or @quarter, it snaps to the beginning of the most recent quarter: Jan 1, Apr 1, July 1, or Oct 1.
By the way I usually use ...-7d instead of -1w.