Need help :
I have a splunk query where i want to evaluate today (day of week) using now() and then use it to compare data for past 4 weeks for same day of week. if today is MOnday, i want to compare data for past 4 mondays with today.
For yesterday or a day before the current day would the below be correct?
| eval yesterday = strftime(relative_time(now(), "-1d@d"), "%w")| eval eventdow=strftime(_time,"%w")| where yesterday=eventdow