I have a customer that needs to have a dashboard showing a start date of Saturday and ending on the current workday. The search that I have tried, with no results, is:
index=| eval today=strftime(now(),"%a")
| eval Backdays=case(today=="Mon",2,today=="Tue",3,today=="Wed",4,today=="Thur",5,today=="Fri",6)
| search earliest=-"Backdays"d@d latest=now
There is definitely data for this past Saturday, Sunday and today (Monday) and the "Backdays" field is populating with a 1 (in this case)
Any help is most appreciated.
Thank you
↧