How to show data for second week of tuesday every month

[emdaax · Accepted solution]

Hi @pavithra

you could try with the ceiling function: ceiling or ceil 

example:

| eval day_of_month=strftime(_time, "%d")
| eval day_of_week=strftime(_time, "%A")
| eval week_of_month=ceil(day_of_month/7)
| where day_of_week="Tuesday" AND week_of_month=2

 
best regards,

[pavithra]

Thanks!!  Its working

[gcusello]

Hi @pavithra ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[emdaax]

Great, I'm glad to hear that this solution was helpful for your use case 👍
happy splunking and best regards ; )


P.S.: Karma Points are always appreciated 😉

[gcusello]

Hi @pavithra 

at first it isn't so clear with timeframe you want to display, but this is inside your search, so if it's the previous month, you could run something like this:

<your_search> earliest=-mon@mon latest=@mon
| stats count BY key

and schedule your search using this cron:

0 0 8-15 * 3

Ciao.

Giuseppe