Splunk Search

How to display data for every sunday of last 3 weeks in the given date and time range?

srujana96
Explorer

Say suppose we have data for the below date and time range, i want to pick only sunday's date and display the last 3 weeks sundays data only. so basically, it should pick only the sunday's date from input data and display it in the output data.

input data            output data(sunday date)

2022-04-24 09:00:03   2022-04-24 09:00:03
2022-04-22 12:50:08   2022-04-17 12:34:26
2022-04-17 12:34:26   2022-03-27 15:49:59
2022-03-28 09:41:12   2022-03-20 11:07:21
2022-03-27 15:49:59   2022-03-20 11:07:21
2022-03-25 15:31:18    
2022-03-25 15:00:32    
2022-03-25 14:45:03    
2022-03-20 13:28:54    
2022-03-20 11:07:21    
2022-03-10 16:11:32    
2022-03-10 14:31:15    
Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Some date fields are automatically extracted - try this

| where date_wday="sunday"
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I don't trust those fields. 😉

But seriously, they are extracted in index-time and are based on the initial timestamp. As far as I remember, you can have a discrepancy between the presented timestamp and the extracted timestamp-related fields if your user is at another timezone than the source/indexer. That part of time processing can be really confusing.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just render your timestamp into a format using a weekday only and compare it with your desired day of the week.

<your search>
| eval weekday=strftime(_time,"%w")
| where weekday=0

Since strftime gives you string you might filter on "0" as string instead of just plain nummerical zero in the last condition (haven't checked).

srujana96
Explorer

Thnaks @PickleRick  it worked!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...