Splunk Search

Is there a function to get the week day from any given epoch time?

Communicator

I know how to get the week day from raw events, the week day is stored in the field date_wday.
However, I wonder if there's a function to compute the week day from an epoch time, as I want to get it from a field on a table which doesn't come from a raw event _time.

Tags (4)
1 Solution

Communicator

I once again replied to my own question... Maybe I shouldn't ask so quickly...

|eval date_wday=strftime(epochtime,"%w")

View solution in original post

Motivator

<search> | eval dayofweekshort=strftime(epochtime,"%a") | eval dayofweekfull=strftime(epochtime,"%A") | eval dayofweekasnumber=strftime(epochtime,"%w")

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

Communicator

I once again replied to my own question... Maybe I shouldn't ask so quickly...

|eval date_wday=strftime(epochtime,"%w")

View solution in original post