I have a Field that contains values in the YYYY-MM-DD. What's the best way to convert it to the day of week? For example if I had a field called ODATE=2015-01-27 then I'd want a field called ODAY_OF_WEEK=Tuesday.
Note- The 'timestamp' ODATE is not the actual timestamp for the log and so I can't use _time.
I've tried to used mktime and strftime, but I haven't figured it out, yet.
Thanks in advance!
This should do it:
... | eval ODAY_OF_WEEK = strftime(strptime(ODATE, "%Y-%m-%d"), "%A")
This should do it:
... | eval ODAY_OF_WEEK = strftime(strptime(ODATE, "%Y-%m-%d"), "%A")