Splunk Search

How can I assign the day of the week to my events?

matt
Splunk Employee
Splunk Employee

I'd like to be able to assign the day of the week to my events so I can show my users whatever happens on a Monday. Is it possible?

Tags (2)
1 Solution

Flynt
Splunk Employee
Splunk Employee

You can get the Monday of the week for any date by using the following -

|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

This is a dummy search using stats count but you can easily inject this into your search and use eval this_mon=_time to use the timestamp of an event.

View solution in original post

Flynt
Splunk Employee
Splunk Employee

You can get the Monday of the week for any date by using the following -

|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

This is a dummy search using stats count but you can easily inject this into your search and use eval this_mon=_time to use the timestamp of an event.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Not only is it possible, it's automatic. Look for the date_wday field.

---
If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!