topic Re: How to subtract one week from the current week in a report name? in Splunk Search

How to subtract one week from the current week in a report name?

VeloCiraptor — Fri, 11 Feb 2022 17:43:21 GMT

Hello everybody,

I have a report that is generated every week.

I want to name the title of the report with the previous week number.

I use the « action.email.reportFileName » field to choose the report generate name

For example :.

We are the 2022/02/11 which is 6th week of the year.

The report is scheduled today but I want to mention the W-1 week -> so the number 5.

I identified that with the variable %V I can dynamically generate the name of the report with the current week.

I'm looking for a trick to put the number of the past week

If someone has a solution please

Kind regards !

Re: How to subtract one week from the current week in a report name?

yuanliu — Sat, 12 Feb 2022 02:04:06 GMT

Like this?

| eval lastweek = tonumber(strftime(_time, "%V")) - 1

Re: How to subtract one week from the current week in a report name?

PickleRick — Sat, 12 Feb 2022 06:15:39 GMT

Might not work very well across the year's beginning.

Could use modulo 52 or offestting back one week before doing strftime.

Another possible issue - what about a week 53/0 (end of last year, beginning of current one) - how should it be counted?

Re: How to subtract one week from the current week in a report name?

woodcock — Sat, 12 Feb 2022 19:35:51 GMT

Something like this:

|makeresults | eval report_day="2022/02/11" | eval previous_report_day = strftime(relative_time(strptime(report_day, "%Y/%m/%d"), "-7days"), "%Y/%m/%d") | eval report_week = strftime(strptime(report_day, "%Y/%m/%d"), "%u") | eval previous_report_week = report_week - 1