Convert Date to Day of Week

[Splunkster45]

I have a Field that contains values in the YYYY-MM-DD. What's the best way to convert it to the day of week? For example if I had a field called ODATE=2015-01-27 then I'd want a field called ODAY_OF_WEEK=Tuesday.

Note- The 'timestamp' ODATE is not the actual timestamp for the log and so I can't use _time.

I've tried to used mktime and strftime, but I haven't figured it out, yet.

Thanks in advance!

[martin_mueller · Accepted solution]

This should do it:

... | eval ODAY_OF_WEEK = strftime(strptime(ODATE, "%Y-%m-%d"), "%A")