Splunk Search

Is there a function to get the Count of the week in an year ?

prakashbhanu407
New Member

Could you please help me with the Below
I have a requirement to get the week of the year and trigger the Alert only on Odd Weeks(Monday).
I am planning to have this logic in subsearch and return the main search results only on Odd Mondays of the year.

Tags (5)
0 Karma
1 Solution

adamsaul
Communicator

prakashbhanu407,

index=foo_bar  | eval WeekOfYear= strftime(_time, "%V")

The above will format the time to the 'WeekOfYear'. From there, you can perform a modulus against the week like below.

index=foo_bar  | eval WeekOfYear = strftime(_time, "%V") | eval ret_val = WeekOfYear % 2

Therefore, if ret_val == 0, it's EVEN. ret_val == 1, it's ODD.

View solution in original post

adamsaul
Communicator

prakashbhanu407,

index=foo_bar  | eval WeekOfYear= strftime(_time, "%V")

The above will format the time to the 'WeekOfYear'. From there, you can perform a modulus against the week like below.

index=foo_bar  | eval WeekOfYear = strftime(_time, "%V") | eval ret_val = WeekOfYear % 2

Therefore, if ret_val == 0, it's EVEN. ret_val == 1, it's ODD.

prakashbhanu407
New Member

Thanks a Ton !!!
Wow It is so simple ...I was not aware of "%V", I was working on stripping the fields from current date.

0 Karma

adamsaul
Communicator

You're welcome!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...