Splunk Search

## How can I assign the day of the week to my events?

Splunk Employee

I'd like to be able to assign the day of the week to my events so I can show my users whatever happens on a Monday. Is it possible?

Tags (2)
1 Solution
Splunk Employee

You can get the Monday of the week for any date by using the following -

``````|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

``````|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

This is a dummy search using stats count but you can easily inject this into your search and use eval thismon=time to use the timestamp of an event.

Splunk Employee

You can get the Monday of the week for any date by using the following -

``````|stats count|eval this_mon=now()|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

All you need is to change the eval of this_mon to the epoch time of the date you want. For example the above will give you the Monday of the week for the current day. If you wanted, say the Monday for August 12th

``````|stats count|eval this_mon=strptime("08-12-2015","%m-%d-%Y")|eval day=strftime(this_mon,"%u") |eval midtoday=strftime(this_mon,"%m/%d/%Y") |eval me=case(day=1,0,day=2,1,day=3,2,day=4,3,day=5,4,day=6,5,day=7,6)|eval new=me*86400|eval newdate=this_mon-new|eval datething=strftime(newdate,"%b %d %Y")|rename datething as monday
``````

This is a dummy search using stats count but you can easily inject this into your search and use eval thismon=time to use the timestamp of an event.

SplunkTrust

Not only is it possible, it's automatic. Look for the `date_wday` field.

---
If this reply helps you, an upvote would be appreciated.