Splunk Search

Need to extract Workweek from date

shivareddysompa
Explorer

I have a date like 2020-06-08 06:39:49.0

I need to extract workweek from it.

Thanks in advance.

Labels (1)
0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="2020-06-08 06:39:49.0"
| eval time=strptime(_raw,"%F %T.%Q")
| eval weekday=strftime(time,"%w") ,day=strftime(time,"%d") ,month_first=strftime(relative_time(time,"@month"),"%w")
| eval weeks=if(month_first <= weekday,floor(day / 7) + 1,floor(day / 7))

I made this query because I thought it was the second week of the month.

What is workweek?

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

I define WorkWeek as the week number in the year, so week 1 is the first week  in Jan and 52  is the last full week in Dec.

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

You can use strftime to create the field.

 

| makeresults | eval WorkWeek = strftime(_time,"%U")
0 Karma