https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347574#M102941 <P>If the <CODE>_Date</CODE> is the same as <CODE>_time</CODE>, then just use the field <CODE>date_wday</CODE>.</P> <P>If you need it in a number, then you can do a <CODE>lookup</CODE> or <CODE>case</CODE>.</P> <P>If <CODE>_Date</CODE> is not the same as <CODE>_time</CODE>, then <STRONG><EM>sbbadri's</EM></STRONG> answer is probably what you want to consider.</P> Thu, 03 Aug 2017 23:31:12 GMT cpetterborg 2017-08-03T23:31:12Z https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347572#M102939 <P>I have extracted a field from log files that is called file_Date and it is in the format "8/1/2017". How do get the day of the week from a date in this format. I CAN NOT use "_time" for when Splunk gets the date forwarded because it can be a different date based on the location of the server.</P> Tue, 29 Sep 2020 15:12:23 GMT https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347572#M102939 griffinpair 2020-09-29T15:12:23Z https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347573#M102940 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/53062">@griffinpair</a></P> <P>Try this, </P> <P>| eval tdate_w = strftime(strptime(file_Date, "%m/%d/%Y"), "%A") | table file_Date tdate_w</P> Tue, 29 Sep 2020 15:14:01 GMT https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347573#M102940 sbbadri 2020-09-29T15:14:01Z https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347574#M102941 <P>If the <CODE>_Date</CODE> is the same as <CODE>_time</CODE>, then just use the field <CODE>date_wday</CODE>.</P> <P>If you need it in a number, then you can do a <CODE>lookup</CODE> or <CODE>case</CODE>.</P> <P>If <CODE>_Date</CODE> is not the same as <CODE>_time</CODE>, then <STRONG><EM>sbbadri's</EM></STRONG> answer is probably what you want to consider.</P> Thu, 03 Aug 2017 23:31:12 GMT https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347574#M102941 cpetterborg 2017-08-03T23:31:12Z https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347575#M102942 <P>NOTE - If you prefer numbers, 0 for Sunday, 1 for Monday and so on, use "%w"</P> Fri, 04 Aug 2017 00:32:59 GMT https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347575#M102942 DalJeanis 2017-08-04T00:32:59Z https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347576#M102943 <P>This works perfectly! Thank you</P> Fri, 04 Aug 2017 17:00:14 GMT https://community.splunk.com/t5/Splunk-Search/Get-Day-of-Week-from-Created-Date-Field-through-extraction/m-p/347576#M102943 griffinpair 2017-08-04T17:00:14Z