<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Results displayed by day in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515386#M34458</link>
    <description>&lt;P&gt;Hi there,&lt;/P&gt;&lt;P&gt;I have a dashboard which splits the results by day of the week, to see for example the amount of events by Days (Monday, Tuesday, ...)&lt;/P&gt;&lt;P&gt;My request is like that:&lt;/P&gt;&lt;P&gt;myrequest | convert timeformat="%A" ctime(_time) AS Day | chart count by Day | rename count as "SENT" | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="saturday",6 ,wd=="sunday",7) | sort sort_field | fields - sort_field, wd&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Only problem with the request is that sometimes a day or two could be missing in the histogram (0 entries), and I wanted to have always the 7 days displayed (even with 0 results).&lt;/P&gt;&lt;P&gt;Any way to do this ? Any help appreciated! (like a left join in SQL)&lt;/P&gt;</description>
    <pubDate>Fri, 21 Aug 2020 07:54:57 GMT</pubDate>
    <dc:creator>sweiland</dc:creator>
    <dc:date>2020-08-21T07:54:57Z</dc:date>
    <item>
      <title>Results displayed by day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515386#M34458</link>
      <description>&lt;P&gt;Hi there,&lt;/P&gt;&lt;P&gt;I have a dashboard which splits the results by day of the week, to see for example the amount of events by Days (Monday, Tuesday, ...)&lt;/P&gt;&lt;P&gt;My request is like that:&lt;/P&gt;&lt;P&gt;myrequest | convert timeformat="%A" ctime(_time) AS Day | chart count by Day | rename count as "SENT" | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="saturday",6 ,wd=="sunday",7) | sort sort_field | fields - sort_field, wd&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Only problem with the request is that sometimes a day or two could be missing in the histogram (0 entries), and I wanted to have always the 7 days displayed (even with 0 results).&lt;/P&gt;&lt;P&gt;Any way to do this ? Any help appreciated! (like a left join in SQL)&lt;/P&gt;</description>
      <pubDate>Fri, 21 Aug 2020 07:54:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515386#M34458</guid>
      <dc:creator>sweiland</dc:creator>
      <dc:date>2020-08-21T07:54:57Z</dc:date>
    </item>
    <item>
      <title>Re: Results displayed by day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515490#M34464</link>
      <description>&lt;P&gt;This works for me.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=_internal 
| timechart span=1d count 
| convert timeformat="%A" ctime(_time) AS Day 
| rename count as "SENT" | eval wd=lower(Day) 
| eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="saturday",6 ,wd=="sunday",7) 
| sort sort_field 
| fields - sort_field, wd 
| table Day SENT&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 21 Aug 2020 15:19:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515490#M34464</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2020-08-21T15:19:02Z</dc:date>
    </item>
    <item>
      <title>Re: Results displayed by day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515497#M34466</link>
      <description>&lt;P&gt;Hmmm nope, here is my first attempt (with my query, I miss the Sunday = 0 event), and also comparison with your query (below)&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="SplunkTest.png" style="width: 926px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/10441i382C4272E37B405F/image-size/large?v=v2&amp;amp;px=999" role="button" title="SplunkTest.png" alt="SplunkTest.png" /&gt;&lt;/span&gt;Maybe I need then a group by ?&lt;/P&gt;</description>
      <pubDate>Fri, 21 Aug 2020 15:42:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515497#M34466</guid>
      <dc:creator>sweiland</dc:creator>
      <dc:date>2020-08-21T15:42:24Z</dc:date>
    </item>
    <item>
      <title>Re: Results displayed by day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515515#M34471</link>
      <description>&lt;P&gt;It looks like my query is producing the zeros you wanted, but has more than one entry for each day.&amp;nbsp; I think we can correct that with stats.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=_internal 
| timechart span=1d count 
| convert timeformat="%A" ctime(_time) AS Day 
| stats sum(count) as count by Day
| rename count as "SENT" 
| eval wd=lower(Day) 
| eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="saturday",6 ,wd=="sunday",7) 
| sort sort_field 
| fields - sort_field, wd 
| table Day SENT&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 21 Aug 2020 16:50:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515515#M34471</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2020-08-21T16:50:50Z</dc:date>
    </item>
    <item>
      <title>Re: Results displayed by day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515547#M34479</link>
      <description>&lt;P&gt;Thanks, it works almost flawlessly ! &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Just a problem when I put "Since start of week", Saturday is missing.. dont know why..&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sweiland_0-1598042307460.png" style="width: 630px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/10446iC9F0C6BD64E0029D/image-dimensions/630x196?v=v2" width="630" height="196" role="button" title="sweiland_0-1598042307460.png" alt="sweiland_0-1598042307460.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;I would have thought that I should miss Saturday &amp;amp; Sunday (because I put start of week and both days are not in the request at all)&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 21 Aug 2020 20:42:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515547#M34479</guid>
      <dc:creator>sweiland</dc:creator>
      <dc:date>2020-08-21T20:42:00Z</dc:date>
    </item>
    <item>
      <title>Re: Results displayed by day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515596#M34487</link>
      <description>&lt;P&gt;"Start of week" is Sunday. Saturday was tomorrow so &lt;FONT face="courier new,courier"&gt;timechart&lt;/FONT&gt; thinks you only care about Sun-Fri. Try using &lt;FONT face="courier new,courier"&gt;latest=+1w@w&lt;/FONT&gt;.&lt;/P&gt;</description>
      <pubDate>Sat, 22 Aug 2020 16:30:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515596#M34487</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2020-08-22T16:30:49Z</dc:date>
    </item>
    <item>
      <title>Re: Results displayed by day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515597#M34488</link>
      <description>&lt;P&gt;Maybe I just find a way to limit the timepicker to 7 days range minimum (but did not find how), or I just do not display the panel if the range is less than 7 days&lt;/P&gt;&lt;P&gt;Both case I do not know how to do, but will try to find &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt; (2nd optionis better, to hide the panel if range too short)&lt;/P&gt;</description>
      <pubDate>Sat, 22 Aug 2020 17:21:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Results-displayed-by-day/m-p/515597#M34488</guid>
      <dc:creator>sweiland</dc:creator>
      <dc:date>2020-08-22T17:21:15Z</dc:date>
    </item>
  </channel>
</rss>

