Splunk Search

Get Day of Week from Created Date Field through extraction

griffinpair
Path Finder

I have extracted a field from log files that is called file_Date and it is in the format "8/1/2017". How do get the day of the week from a date in this format. I CAN NOT use "_time" for when Splunk gets the date forwarded because it can be a different date based on the location of the server.

0 Karma
1 Solution

sbbadri
Motivator

@griffinpair

Try this,

| eval tdate_w = strftime(strptime(file_Date, "%m/%d/%Y"), "%A") | table file_Date tdate_w

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

If the _Date is the same as _time, then just use the field date_wday.

If you need it in a number, then you can do a lookup or case.

If _Date is not the same as _time, then sbbadri's answer is probably what you want to consider.

sbbadri
Motivator

@griffinpair

Try this,

| eval tdate_w = strftime(strptime(file_Date, "%m/%d/%Y"), "%A") | table file_Date tdate_w

DalJeanis
Legend

NOTE - If you prefer numbers, 0 for Sunday, 1 for Monday and so on, use "%w"

0 Karma

griffinpair
Path Finder

This works perfectly! Thank you

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...