Splunk Search

Need to extract Workweek from date

shivareddysompa
Explorer

I have a date like 2020-06-08 06:39:49.0

I need to extract workweek from it.

Thanks in advance.

Labels (1)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="2020-06-08 06:39:49.0"
| eval time=strptime(_raw,"%F %T.%Q")
| eval weekday=strftime(time,"%w") ,day=strftime(time,"%d") ,month_first=strftime(relative_time(time,"@month"),"%w")
| eval weeks=if(month_first <= weekday,floor(day / 7) + 1,floor(day / 7))

I made this query because I thought it was the second week of the month.

What is workweek?

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

I define WorkWeek as the week number in the year, so week 1 is the first week  in Jan and 52  is the last full week in Dec.

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

You can use strftime to create the field.

 

| makeresults | eval WorkWeek = strftime(_time,"%U")
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...