Splunk Search
Highlighted

Why is the date 2017-01-01 marked as calenderweek 2017-52 when using eval strftime?

Motivator

Hi,

I'm calculating the calenderweek with this:

| eval calenderweek=strftime(_time,"%Y-%V")

For some reason for 2017-01-01, the calenderweek is 2017-52, any ideas why?

Date -> Calenderweek
2017-01-03 -> 2017-01
2017-01-02 -> 2017-01
2017-01-01 -> 2017-52
2016-12-31 -> 2016-52
2017-12-30 -> 2016-52

Thanks in advance,
Heinz

0 Karma
Highlighted

Re: Why is the date 2017-01-01 marked as calenderweek 2017-52 when using eval strftime?

Motivator

Think I got it myself...
I'm calculating year & week separately. Better approach would be

| eval week=relativetime(time,"@w1")
| eval week=strftime(week,"%Y-%m-%d")

View solution in original post