Splunk Search

Why is the date 2017-01-01 marked as calenderweek 2017-52 when using eval strftime?

HeinzWaescher
Motivator

Hi,

I'm calculating the calenderweek with this:

| eval calenderweek=strftime(_time,"%Y-%V")

For some reason for 2017-01-01, the calenderweek is 2017-52, any ideas why?

Date -> Calenderweek
2017-01-03 -> 2017-01
2017-01-02 -> 2017-01
2017-01-01 -> 2017-52
2016-12-31 -> 2016-52
2017-12-30 -> 2016-52

Thanks in advance,
Heinz

0 Karma
1 Solution

HeinzWaescher
Motivator

Think I got it myself...
I'm calculating year & week separately. Better approach would be

| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%Y-%m-%d")

View solution in original post

HeinzWaescher
Motivator

Think I got it myself...
I'm calculating year & week separately. Better approach would be

| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%Y-%m-%d")

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...