Splunk Search

How to subtract one week from the current week in a report name?

VeloCiraptor
Observer

Hello everybody,

I have a report that is generated every week.

I want to name the title of the report with the previous week number.

I use the « action.email.reportFileName » field to choose the report generate name

For example :.

We are the 2022/02/11  which is 6th week of the year.

The report is scheduled today but I want to mention the W-1 week -> so the number 5.

I identified that with the variable %V I can dynamically generate the name of the report with the current week.

I'm looking for a trick to put the number of the past week

If someone has a solution please

Kind regards !

Labels (1)
Tags (1)
0 Karma

woodcock
Esteemed Legend

Something like this:

|makeresults
| eval report_day="2022/02/11"
| eval previous_report_day = strftime(relative_time(strptime(report_day, "%Y/%m/%d"), "-7days"), "%Y/%m/%d")
| eval report_week = strftime(strptime(report_day, "%Y/%m/%d"), "%u")
| eval previous_report_week = report_week - 1
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like this?

| eval lastweek = tonumber(strftime(_time, "%V")) - 1
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might not work very well across the year's beginning.

Could use modulo 52 or offestting back one week before doing strftime.

Another possible issue - what about a week 53/0 (end of last year, beginning of current one) - how should it be counted?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...