Hi.
I want to calculate the weekdays in a month, using this:
| gentimes start=11/01/16 end=11/31/16 | search starthuman!="Sun*" starthuman!="Sat*" | stats count
My problem is that i need to count the saturdays as 1/2 day, for example: Without Sat/Sun, July has 21 weekdays. July has 4 saturdays, so i must add 0.5 * 4, then, the total count is 23. How i can do this?
Any help please?
Thanks!
Try this
| gentimes start=11/01/16 end=11/31/16 | eval dow=strftime(starttime, "%w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)
*UPDATED*
| makeresults | eval start=relative_time(now(), "@mon") | eval end=relative_time(now(), "+1mon@mon-1d") | eval mon=mvrange(start, end, "1d") | mvexpand mon | eval dow=strftime(mon, "%-w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)
Try this
| gentimes start=11/01/16 end=11/31/16 | eval dow=strftime(starttime, "%w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)
*UPDATED*
| makeresults | eval start=relative_time(now(), "@mon") | eval end=relative_time(now(), "+1mon@mon-1d") | eval mon=mvrange(start, end, "1d") | mvexpand mon | eval dow=strftime(mon, "%-w") | stats count(eval(dow>0 AND dow<6)) as weekday count(eval(dow=6)) as sat | eval weekdays=weekday+(sat/2)
Awesome! Some way to do to the current month and delete start/end dates?
Try updated answer
Last question: i created a search macro with this and when i ran, splunk returns:
Error in 'makeresults' command: This
command must be the first command of a
search.
Any idea?
can you show us where you use the macro?
After created, i try to call in the search bar: workdayswithsat
With ` begin/end
You probably don't need |makeresults
. Try without it.
This should work
| gentimes start=11/01/16 end=11/31/16 | search starthuman!="Sun*" |rex field=starthuman "^(?<day>\C{3}).*" | eval daycount = if(day=="Sat",0.5,1) | stats sum(daycount)
Awesome! Some way to do to the current month and delete start/end dates?
try @sundareshr updated answer 🙂 this is really great