In a Splunk search, how do I modify the date so that the week numbers match up to actual week numbers in Calendar?

[QuintonS]

I have the following query:

| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%m%d %V")
| stats sum(rh) as RH sum(cmplt_reading_only) as ReadOnly by week

Sample output below:

week,                 RH,          Readonly
08/27 35.         10000.         59
09/03 36          10000.         59

The problem is that the week numbers are not matching to actual week numbers in Calendar, for example Week 35 is starting on Monday 08/27 but should be Monday 08/20. Can someone please help me on how to correct this?

[FrankVl · Accepted solution]

In what calendar does week 35 start on 8/20? In my calendar it starts at 8/27. I know there are different ways of calculating week numbers, so perhaps in your location it is common to use a different method, which shifts things by 1 week (this year)?

strftime supports different ways of printing week numbers:

%U  Week number of the given year, starting with the first Sunday as the first week
%V  ISO-8601:1988 week number of the given year, starting with the first week of the year with at least 4 weekdays, with Monday being the start of the week
%W  A numeric representation of the week of the year, starting with the first Monday as the first week

See which one suits you best.

[QuintonS]

You are 100% correct, it turns out the Calendar on my MAC shows the week numbers at the end of the week and thats why i read it incorrectly...my date is perfect! Rookie mistake!! 🙂