Splunk Search

How to subtract one week from the current week in a report name?

VeloCiraptor
Observer

Hello everybody,

I have a report that is generated every week.

I want to name the title of the report with the previous week number.

I use the « action.email.reportFileName » field to choose the report generate name

For example :.

We are the 2022/02/11  which is 6th week of the year.

The report is scheduled today but I want to mention the W-1 week -> so the number 5.

I identified that with the variable %V I can dynamically generate the name of the report with the current week.

I'm looking for a trick to put the number of the past week

If someone has a solution please

Kind regards !

Labels (2)
Tags (1)
0 Karma

woodcock
Esteemed Legend

Something like this:

|makeresults
| eval report_day="2022/02/11"
| eval previous_report_day = strftime(relative_time(strptime(report_day, "%Y/%m/%d"), "-7days"), "%Y/%m/%d")
| eval report_week = strftime(strptime(report_day, "%Y/%m/%d"), "%u")
| eval previous_report_week = report_week - 1
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like this?

| eval lastweek = tonumber(strftime(_time, "%V")) - 1
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might not work very well across the year's beginning.

Could use modulo 52 or offestting back one week before doing strftime.

Another possible issue - what about a week 53/0 (end of last year, beginning of current one) - how should it be counted?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...