Splunk Search

Get Day of Week from Created Date Field through extraction

griffinpair
Path Finder

I have extracted a field from log files that is called file_Date and it is in the format "8/1/2017". How do get the day of the week from a date in this format. I CAN NOT use "_time" for when Splunk gets the date forwarded because it can be a different date based on the location of the server.

0 Karma
1 Solution

sbbadri
Motivator

@griffinpair

Try this,

| eval tdate_w = strftime(strptime(file_Date, "%m/%d/%Y"), "%A") | table file_Date tdate_w

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

If the _Date is the same as _time, then just use the field date_wday.

If you need it in a number, then you can do a lookup or case.

If _Date is not the same as _time, then sbbadri's answer is probably what you want to consider.

sbbadri
Motivator

@griffinpair

Try this,

| eval tdate_w = strftime(strptime(file_Date, "%m/%d/%Y"), "%A") | table file_Date tdate_w

DalJeanis
Legend

NOTE - If you prefer numbers, 0 for Sunday, 1 for Monday and so on, use "%w"

0 Karma

griffinpair
Path Finder

This works perfectly! Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...