Splunk Search

COnvert week number to the 1st date in that week

nikita012
New Member

Below is the data. Weeknum is the number of week where 01-05 are week numbers from 2019 and 40-44 are week numbers from 2018. I want to generate a chart for the same data with x-axis as the first date of each week number. Ex- 40 should be Oct 1, 2018 and 01 should be 30/12/2018. How do I do it?

week Total
01 3
02 2
03 1
04 1
05 3
40 4
41 9
42 4
43 5
44 10

0 Karma
1 Solution

niketn
Legend

@nikita012 please try one of my older answers https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

nikita012
New Member

alt text

Following is the code:-

| eval Dates=strptime(Date, "%m/%d/%Y")
| sort Dates
| eval Dates=strftime(Dates, "%d/%m/%Y")
| eval weeknum=strftime(relative_time(strptime(Dates,"%d/%m/%Y"),"@w2"),"%Y/%V")
| stats min(_time) as MinTime by weeknum
| eval MinTime=strftime(MinTime,"%m/%d/%Y")
| eval WeekStartDate=strftime(relative_time(strptime(MinTime,"%m/%d/%Y"),"-0w@w"),"%m/%d/%Y")

This code is not giving the start date of each weeknum. 2018/39 should be 01/10/2018. It's taking the start date of the current week. How should I reslove it?

0 Karma

niketn
Legend

@nikita012 please try one of my older answers https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nikita012
New Member

alt text

I applied the code and got year no./week no. on x-axis. Ex- 2018/39 where 2018 is the year no. and 39 is the week no. How can I get the first date of that week on x-axis. Can you please provide the code for it. Ex- 2019/01 should be 01/01/2019.

0 Karma

niketn
Legend

@nikita012 I am not sure how the post does not help with your current query?
Following is a run anywhere example which converts your time format data %Y/%U to %m/%d/%Y

index=_internal sourcetype=splunkd log_level!=ERROR component=Exec* 
| eval WeekOfYear=strftime(_time,"%Y/%U") 
| stats count as Errors min(_time) as MinTime by WeekOfYear 
| eval MinTime=strftime(MinTime,"%m/%d/%Y") 
| eval WeekStartDate=strftime(relative_time(strptime(MinTime,"%m/%d/%Y"),"-0w@w"),"%m/%d/%Y")
| table WeekStartDate Errors
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...