how to group events per weeknumber ?

[yannK]

I tried different methods, but couldn't group events per week.
with span=1week, it seems to do a rotating 7 days.

Any way to define the weeknumber in splunk ?

[olex_k7]

It may have been "strftime(_time,"%U")" as yannK said.
But in the current Splunk version is the week number defined by "%V"

So, the code snippet should be:

| eval dateyearweek=strftime(_time,"%Y-%V")| stats count by dateyearweek

See Docs for more info. Best Regards!

[yannK · Accepted solution]

I found a workaround for searches and dashboard is to manually extract them after the search using a strftime

… | eval weeknumber=strftime(_time,"%U") | stats count by weeknumber

To avoid confusions between years, I like to use the year, that help to sort them in chronological order.

… | eval dateyearweek=strftime(_time,"%Y-%U")| stats count by dateyearweek

Depending of your country, you have 2 variations :

• %U is replaced by the week number of the year (Sunday as the first day of the week) as a decimal number [00,53].
• %V is replaced by the week number of the year (Monday as the first day of the week) as a decimal number [01,53]. If the week containing 1 January has four or more days in the new year, then it is considered week 1. Otherwise, it is the last week of the previous year, and the next week is week 1.