Splunk Search

Is there a function to get the Count of the week in an year ?

prakashbhanu407
New Member

Could you please help me with the Below
I have a requirement to get the week of the year and trigger the Alert only on Odd Weeks(Monday).
I am planning to have this logic in subsearch and return the main search results only on Odd Mondays of the year.

Tags (5)
0 Karma
1 Solution

adamsaul
Communicator

prakashbhanu407,

index=foo_bar  | eval WeekOfYear= strftime(_time, "%V")

The above will format the time to the 'WeekOfYear'. From there, you can perform a modulus against the week like below.

index=foo_bar  | eval WeekOfYear = strftime(_time, "%V") | eval ret_val = WeekOfYear % 2

Therefore, if ret_val == 0, it's EVEN. ret_val == 1, it's ODD.

View solution in original post

adamsaul
Communicator

prakashbhanu407,

index=foo_bar  | eval WeekOfYear= strftime(_time, "%V")

The above will format the time to the 'WeekOfYear'. From there, you can perform a modulus against the week like below.

index=foo_bar  | eval WeekOfYear = strftime(_time, "%V") | eval ret_val = WeekOfYear % 2

Therefore, if ret_val == 0, it's EVEN. ret_val == 1, it's ODD.

prakashbhanu407
New Member

Thanks a Ton !!!
Wow It is so simple ...I was not aware of "%V", I was working on stripping the fields from current date.

0 Karma

adamsaul
Communicator

You're welcome!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...