Splunk Search

Is there a function to get the Count of the week in an year ?

prakashbhanu407
New Member

Could you please help me with the Below
I have a requirement to get the week of the year and trigger the Alert only on Odd Weeks(Monday).
I am planning to have this logic in subsearch and return the main search results only on Odd Mondays of the year.

Tags (5)
0 Karma
1 Solution

adamsaul
Communicator

prakashbhanu407,

index=foo_bar  | eval WeekOfYear= strftime(_time, "%V")

The above will format the time to the 'WeekOfYear'. From there, you can perform a modulus against the week like below.

index=foo_bar  | eval WeekOfYear = strftime(_time, "%V") | eval ret_val = WeekOfYear % 2

Therefore, if ret_val == 0, it's EVEN. ret_val == 1, it's ODD.

View solution in original post

adamsaul
Communicator

prakashbhanu407,

index=foo_bar  | eval WeekOfYear= strftime(_time, "%V")

The above will format the time to the 'WeekOfYear'. From there, you can perform a modulus against the week like below.

index=foo_bar  | eval WeekOfYear = strftime(_time, "%V") | eval ret_val = WeekOfYear % 2

Therefore, if ret_val == 0, it's EVEN. ret_val == 1, it's ODD.

View solution in original post

prakashbhanu407
New Member

Thanks a Ton !!!
Wow It is so simple ...I was not aware of "%V", I was working on stripping the fields from current date.

0 Karma

adamsaul
Communicator

You're welcome!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!