https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76373#M19310 <P>I mean to say that I want week number from this search so that I can make chart wrt week number</P> Wed, 22 Feb 2012 10:24:25 GMT kml_uvce 2012-02-22T10:24:25Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76367#M19304 <P>I have a field like in this format 2012-02-11<BR /> This field is in many events with diffrent year-month-day.</P> <P>I want to make a search in which I can extaract information wrt month and week from this field.<BR /> How I can do this</P> Wed, 22 Feb 2012 09:59:58 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76367#M19304 kml_uvce 2012-02-22T09:59:58Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76368#M19305 <PRE><CODE>... | rex field=yourfield "(?&lt;year&gt;.+?)-(?&lt;month&gt;.+?)-(?&lt;day&gt;.+)" </CODE></PRE> <P>Substitute <CODE>yourfield</CODE> with whatever your field is called.</P> Wed, 22 Feb 2012 10:13:33 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76368#M19305 Ayn 2012-02-22T10:13:33Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76369#M19306 <P>ok it works for month , but how I can figure out about the week</P> Wed, 22 Feb 2012 10:19:01 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76369#M19306 kml_uvce 2012-02-22T10:19:01Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76370#M19307 <P>What do you mean by week, week number?</P> Wed, 22 Feb 2012 10:20:00 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76370#M19307 Ayn 2012-02-22T10:20:00Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76371#M19308 <P>yes, its week number</P> Wed, 22 Feb 2012 10:22:21 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76371#M19308 kml_uvce 2012-02-22T10:22:21Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76372#M19309 <P>Not easily done, as that will change from year to year. Your best bet would probably be to create a lookup file that maps dates to week numbers and use that.</P> Wed, 22 Feb 2012 10:24:09 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76372#M19309 Ayn 2012-02-22T10:24:09Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76373#M19310 <P>I mean to say that I want week number from this search so that I can make chart wrt week number</P> Wed, 22 Feb 2012 10:24:25 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76373#M19310 kml_uvce 2012-02-22T10:24:25Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76374#M19311 <P>Correcting myself - apparently <CODE>strftime</CODE> can handle this, using the %u (week starting on Monday) or %U (week starting on Sunday) parameter!</P> <P>You could do something like this to get the week number:</P> <PRE><CODE>eval week=strftime(strptime(yourfield,"%Y-%m-%d"),"%U") </CODE></PRE> Wed, 22 Feb 2012 10:31:47 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76374#M19311 Ayn 2012-02-22T10:31:47Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76375#M19312 <P>cool it works , also is there any way to find month name also (jan ,feb etc) form search?</P> Wed, 22 Feb 2012 10:40:24 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76375#M19312 kml_uvce 2012-02-22T10:40:24Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76376#M19313 <P>Yes, using the same technique. Look up all strftime parameters, there are many different ones.</P> Wed, 22 Feb 2012 10:41:13 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76376#M19313 Ayn 2012-02-22T10:41:13Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76377#M19314 <P>I am not able to find out the complete doc for strftime, can you make this search ?</P> Wed, 22 Feb 2012 12:05:06 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76377#M19314 kml_uvce 2012-02-22T12:05:06Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76378#M19315 <P>With all due respect: <A href="http://lmgtfy.com/?q=strftime">http://lmgtfy.com/?q=strftime</A></P> Wed, 22 Feb 2012 12:07:29 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76378#M19315 Ayn 2012-02-22T12:07:29Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76379#M19316 <P>Thanks this works for me now...</P> Wed, 22 Feb 2012 12:09:48 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76379#M19316 kml_uvce 2012-02-22T12:09:48Z https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76380#M19317 <P>Excellent. Could you please mark my answer as accepted? Thanks!</P> Wed, 22 Feb 2012 12:51:32 GMT https://community.splunk.com/t5/Splunk-Search/To-findout-month-and-week-from-a-Field/m-p/76380#M19317 Ayn 2012-02-22T12:51:32Z