Splunk Search

How to subtract one week from the current week in a report name?

VeloCiraptor
Observer

Hello everybody,

I have a report that is generated every week.

I want to name the title of the report with the previous week number.

I use the « action.email.reportFileName » field to choose the report generate name

For example :.

We are the 2022/02/11  which is 6th week of the year.

The report is scheduled today but I want to mention the W-1 week -> so the number 5.

I identified that with the variable %V I can dynamically generate the name of the report with the current week.

I'm looking for a trick to put the number of the past week

If someone has a solution please

Kind regards !

Labels (2)
Tags (1)
0 Karma

woodcock
Esteemed Legend

Something like this:

|makeresults
| eval report_day="2022/02/11"
| eval previous_report_day = strftime(relative_time(strptime(report_day, "%Y/%m/%d"), "-7days"), "%Y/%m/%d")
| eval report_week = strftime(strptime(report_day, "%Y/%m/%d"), "%u")
| eval previous_report_week = report_week - 1
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like this?

| eval lastweek = tonumber(strftime(_time, "%V")) - 1
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might not work very well across the year's beginning.

Could use modulo 52 or offestting back one week before doing strftime.

Another possible issue - what about a week 53/0 (end of last year, beginning of current one) - how should it be counted?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...