How can I assign the day of the week to my events?

[matt]

I'd like to be able to assign the day of the week to my events so I can show my users whatever happens on a Monday. Is it possible?

[Flynt · Accepted solution]

You can get the Monday of the week for any date by using the following -

|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

This is a dummy search using stats count but you can easily inject this into your search and use eval this_mon=_time to use the timestamp of an event.

[richgalloway]

Not only is it possible, it's automatic. Look for the date_wday field.