Splunk Search

Week details to be dispalyed in a filter ex: week1(1st-7th apr) , week2 (8th -14th Apr)

rijinc
Explorer

Hi All,

I have a reported date time field which i am converting and displaying as a month filter - which contains values as Jan -2019 , Feb -2019
ex : Reported date time field = 05/05/2019 16:29 (%d/%m/%Y %H:%M)

Is it possible to show week filter which will be depended on Month filter.

For ex : if I select month (Apr -19) from the filter, the week filter should display something like week 1 , week2, week3 for the month of APr 19

let me know if this is possible ? Hope to get a response as i tried all possibilities which i know....Need help

0 Karma
1 Solution

nabeel652
Builder

Hope this will help:

"your query that includes _time field"   | eval weeknumber=strftime(_time,"%V") | eval day = strftime(_time,"%d-%b-%y") | eval dt = strftime(strptime(strftime(_time,"01-%m-%Y"),"%d-%m-%Y"),"%V") | eval weeknumber = if(strftime(_time,"%m") == "12" AND weeknumber = "01","53",weeknumber) | eval weeknumber = "Week - ".(weeknumber-dt+1)

%v will give you Mon-Sun week and %u will give you Sun-Sat week - whatever you need. I've left extra fields in for explanation sake. You can filter them out.

View solution in original post

0 Karma

nabeel652
Builder

Hope this will help:

"your query that includes _time field"   | eval weeknumber=strftime(_time,"%V") | eval day = strftime(_time,"%d-%b-%y") | eval dt = strftime(strptime(strftime(_time,"01-%m-%Y"),"%d-%m-%Y"),"%V") | eval weeknumber = if(strftime(_time,"%m") == "12" AND weeknumber = "01","53",weeknumber) | eval weeknumber = "Week - ".(weeknumber-dt+1)

%v will give you Mon-Sun week and %u will give you Sun-Sat week - whatever you need. I've left extra fields in for explanation sake. You can filter them out.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...