Splunk Search

## How can I assign the day of the week to my events?

Splunk Employee

I'd like to be able to assign the day of the week to my events so I can show my users whatever happens on a Monday. Is it possible?

Tags (2)
1 Solution
Splunk Employee

You can get the Monday of the week for any date by using the following -

``````|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

``````|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

This is a dummy search using stats count but you can easily inject this into your search and use eval this_mon=_time to use the timestamp of an event.

Splunk Employee

You can get the Monday of the week for any date by using the following -

``````|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

``````|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

This is a dummy search using stats count but you can easily inject this into your search and use eval this_mon=_time to use the timestamp of an event.

SplunkTrust

Not only is it possible, it's automatic. Look for the `date_wday` field.

---
If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

### Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey.Earn \$50 in Amazon cash! Full Details! >

Get Updates on the Splunk Community!