topic Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW in Splunk Search https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564434#M196624 <P>sample queries for&nbsp;</P><P><SPAN class="mw-headline">Compare a day of the week to the same day of the previous weeks</SPAN></P> Mon, 23 Aug 2021 22:12:41 GMT MayankChandra 2021-08-23T22:12:41Z want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564429#M196622 <P>Need help :</P><P>&nbsp;</P><P>I have a splunk query where i want to evaluate today (day of week) using now() and then use it to compare data for past 4 weeks for same day of week. if today is MOnday, i want to compare data for past 4 mondays with today.</P> Mon, 23 Aug 2021 21:36:52 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564429#M196622 MayankChandra 2021-08-23T21:36:52Z Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564430#M196623 <P>Can someone provide some examples?</P> Mon, 23 Aug 2021 21:37:47 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564430#M196623 MayankChandra 2021-08-23T21:37:47Z Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564434#M196624 <P>sample queries for&nbsp;</P><P><SPAN class="mw-headline">Compare a day of the week to the same day of the previous weeks</SPAN></P> Mon, 23 Aug 2021 22:12:41 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564434#M196624 MayankChandra 2021-08-23T22:12:41Z Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564441#M196625 <LI-CODE lang="markup">| eval dow=strftime(now(),"%w") | eval eventdow=strftime(_time,"%w") | where dow=eventdow</LI-CODE> Mon, 23 Aug 2021 22:36:44 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564441#M196625 ITWhisperer 2021-08-23T22:36:44Z Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564442#M196626 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;Thanks a ton!!</P> Mon, 23 Aug 2021 22:43:03 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564442#M196626 MayankChandra 2021-08-23T22:43:03Z Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564444#M196628 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;One more question. If i want to evaluate yesterday and then perform the comparisons with same day of week (which yesterday evaluates to) with previous weeks what would be the query?</P> Mon, 23 Aug 2021 22:46:31 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564444#M196628 MayankChandra 2021-08-23T22:46:31Z Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564446#M196630 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P>For yesterday or a day before the current day would the below be correct?</P><P>| eval yesterday = strftime(relative_time(now(), "-1d@d"), "%w")| eval eventdow=strftime(_time,"%w")| where yesterday=eventdow</P> Mon, 23 Aug 2021 23:29:00 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564446#M196630 MayankChandra 2021-08-23T23:29:00Z Re: want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564481#M196640 <P>Yes, that would be correct</P> Tue, 24 Aug 2021 08:13:28 GMT https://community.splunk.com/t5/Splunk-Search/want-the-current-day-of-the-week-with-now-then-i-want-to-use/m-p/564481#M196640 ITWhisperer 2021-08-24T08:13:28Z