All Apps and Add-ons

Can I get today's weekday in splunk search?

hqw
Path Finder

hi all,

May i know if there is a function to get the system current weekday ?

for example, the system time ="2015-09-09 10:00:00" but what i want is wednesday,because i just want to show those results. my thing command: where weekday= relative_time(now(),"%A"), but it is not working, currently i just use where weekday="@w3" in command, but till tomorrow, i need change it to Thursday manually. that is why i want to get the system current weekday, so it can change automatically.

Please kindly help this, thanks

Best Regards

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi hqw,

you can get the current day and use it in your search like this:

index=_internal | eval weekday=strftime(now(),"%A") | stats count by weekday

or like this:

index=_internal earliest=0 | eval weekday=strftime(now(),"%A") | eval weekday=lower(weekday) | where date_wday=weekday | stats count by weekday

Hope this helps ...

cheers, MuS

View solution in original post

landen99
Motivator

|  makeresults
|  eval weekday=strftime(_time,"%A")
|  table weekday

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi hqw,

you can get the current day and use it in your search like this:

index=_internal | eval weekday=strftime(now(),"%A") | stats count by weekday

or like this:

index=_internal earliest=0 | eval weekday=strftime(now(),"%A") | eval weekday=lower(weekday) | where date_wday=weekday | stats count by weekday

Hope this helps ...

cheers, MuS

hqw
Path Finder

Hi Mus,

The second one is really helpful for my question, thanks very much.

Best regards
Hqw

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>