Splunk Search

How can I assign the day of the week to my events?

Splunk Employee
Splunk Employee

I'd like to be able to assign the day of the week to my events so I can show my users whatever happens on a Monday. Is it possible?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

You can get the Monday of the week for any date by using the following -

|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

This is a dummy search using stats count but you can easily inject this into your search and use eval thismon=time to use the timestamp of an event.

View solution in original post

Splunk Employee
Splunk Employee

You can get the Monday of the week for any date by using the following -

|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday

This is a dummy search using stats count but you can easily inject this into your search and use eval thismon=time to use the timestamp of an event.

View solution in original post

SplunkTrust
SplunkTrust

Not only is it possible, it's automatic. Look for the date_wday field.

---
If this reply helps you, an upvote would be appreciated.