I know how to get the week day from raw events, the week day is stored in the field date_wday.
However, I wonder if there's a function to compute the week day from an epoch time, as I want to get it from a field on a table which doesn't come from a raw event _time.
I once again replied to my own question... Maybe I shouldn't ask so quickly...
|eval date_wday=strftime(epochtime,"%w")
<search> | eval dayofweekshort=strftime(epochtime,"%a") | eval dayofweekfull=strftime(epochtime,"%A") | eval dayofweekasnumber=strftime(epochtime,"%w")
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
I once again replied to my own question... Maybe I shouldn't ask so quickly...
|eval date_wday=strftime(epochtime,"%w")