topic Re: Snap to previous Friday in Splunk Search

Snap to previous Friday

jclemons7 — Wed, 06 Apr 2016 16:09:22 GMT

Hello,

I have the following time modifier, which I was hoping would give me the previous Friday as a static date, but it doesn't for obvious reasons.

earliest=-7d@w5 latest=-7d@w6 | eval TimeStamp=strftime(strptime(timestamp, "%Y-%m-%dT%H:%M:%S"),"%m/%d/%Y %H") | dedup TimeStamp | table TimeStamp

What I'm trying to do is craft a query that will always pull the previous Friday (or whatever full weekday I chose).

Any help is greatly appreciated.

Re: Snap to previous Friday

woodcock — Wed, 06 Apr 2016 16:15:05 GMT

Try w5-7d@d and w6-7d@d

Re: Snap to previous Friday

jclemons7 — Wed, 06 Apr 2016 16:23:52 GMT

Thanks so much for your response,

I think this is similar to the problem I had before.. so, in my query I wanted previous Sunday let's say.. so using your syntax I wrote this:

earliest=@w0-7d latest=@w1-7d | eval TimeStamp=strftime(strptime(timestamp, "%Y-%m-%dT%H:%M:%S"),"%m/%d/%Y %H") | dedup TimeStamp | table TimeStamp

But that returns 3/27 for my date and what I'm really looking for would be 4/3 if run today (4/6) if that makes any sense..

Re: Snap to previous Friday

jclemons7 — Wed, 06 Apr 2016 16:25:52 GMT

Additionally.. if I run it today for Wednesday, I wouldn't want it to consider today and only return partial results.. I was looking for it to return last Wednesday..

I know in SQL this is tricky, but was hoping Splunk had something that would get me like 90% there.

Re: Snap to previous Friday

woodcock — Wed, 06 Apr 2016 16:43:24 GMT

OK, so do @w0@d and @w1@d.

Re: Snap to previous Friday

somesoni2 — Wed, 06 Apr 2016 17:31:11 GMT

If you're just looking to get the date, from today, for a specific weekday, you can try this run anywhere sample query. Just update the weekday filter in the where clause.

| gentimes start=-7 | table starttime | where strftime(starttime,"%a")="Fri" | eval timestamp=strftime(starttime,"%m/%d/%Y %H")