want the current day of the week with now() then i want to use value to compare data for past 4 weeks for same DOW

[MayankChandra]

Need help :

I have a splunk query where i want to evaluate today (day of week) using now() and then use it to compare data for past 4 weeks for same day of week. if today is MOnday, i want to compare data for past 4 mondays with today.

[ITWhisperer · Accepted solution]

| eval dow=strftime(now(),"%w")
| eval eventdow=strftime(_time,"%w")
| where dow=eventdow

[MayankChandra]

@ITWhisperer One more question. If i want to evaluate yesterday and then perform the comparisons with same day of week (which yesterday evaluates to) with previous weeks what would be the query?

[MayankChandra]

@ITWhisperer 

For yesterday or a day before the current day would the below be correct?

| eval yesterday = strftime(relative_time(now(), "-1d@d"), "%w")| eval eventdow=strftime(_time,"%w")| where yesterday=eventdow

[ITWhisperer]

Yes, that would be correct

[MayankChandra]

@ITWhisperer Thanks a ton!!

[MayankChandra]

sample queries for 

Compare a day of the week to the same day of the previous weeks

[MayankChandra]

Can someone provide some examples?