Looking to create 2 timeframes but "week of month" is returning week of year

[jjponderosa]

Hello. I am interested in data that occurs from Tuesday night on 8 PM until 6 AM. The caveat is that I need 2 separate time periods to compare. One of which is the 2nd Tuesday of each month until the 3rd Thursday. The other is any other day in the month. 


So far I have: 

| eval day_of_week=strftime(_time, "%A")
| eval week_of_month=strftime(_time, "%U" )
| eval day_of_month=strftime(_time, "%d")
| eval start_target_period=if(day_of_week=="Tuesday" AND week_of_month>1 AND week_of_month<4, "true", "false")
| eval end_target_period=if(day_of_week=="Thursday" AND week_of_month>2 AND week_of_monthr<4, "true", "false")
| eval hour=strftime(_time, "%H")
| eval time_bucket=case(
(start_target_period="true" AND hour>="20") OR (end_target_period="true" AND hour<="06"), "Target Period",
(hour>="20" OR hour<="06"), "Other Period"
)

My issue is that my "week of month" field is reflecting the week of the year. Any help would be greatly appreciated. 

EDIT: I placed this in the wrong location, all apologies. 

[bowesmana · Accepted solution]

%U is week of year

https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Commontimeformatvariables#Specify...

You can easily do the math to work out which week of month it is based on your start day of the week. See this example which calculates the week number with either a start of week being Sunday or Monday.

| makeresults count=31
| streamstats c
| eval _time=strptime(printf("2024-03-%02d", c), "%F")
| fields - c
| eval day_of_week=strftime(_time, "%A")
| eval day_of_month=strftime(_time, "%d")
| eval wday_sunday_start=strftime(_time, "%w"), wday_monday_start=if(wday_sunday_start=0,7,wday_sunday_start)
| eval week_of_month_sunday_start=ceil(max((day_of_month-wday_sunday_start), 0) / 7) + 1
| eval week_of_month_monday_start=ceil(max((day_of_month-wday_monday_start), 0) / 7) + 1

[jjponderosa]

Dang it I don’t know how I missed that. Thank you.