topic Re: How to display weekly data starting on a Monday using timecharts? in Splunk Search

How to display weekly data starting on a Monday using timecharts?

samwatson45 — Wed, 18 Jul 2018 15:21:08 GMT

I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday?

Thanks,
Sam

Re: How to display weekly data starting on a Monday using timecharts?

somesoni2 — Wed, 18 Jul 2018 15:46:32 GMT

Try adding this before your timechart command.

| eval _time=relative_time(_time,"@w1") | timechart span=1w ....

Re: How to display weekly data starting on a Monday using timecharts?

samwatson45 — Thu, 19 Jul 2018 10:26:03 GMT

Hmm this still starts it on a Thursday. If i change the number to, say, "@w4" or "@w5" it just skips to the following Thursday.

Re: How to display weekly data starting on a Monday using timecharts?

adonio — Thu, 19 Jul 2018 12:51:52 GMT

see here:
https://answers.splunk.com/answers/562033/why-is-time-chart-with-span-of-1w-always-thursday.html

Re: How to display weekly data starting on a Monday using timecharts?

woodcock — Thu, 19 Jul 2018 14:23:04 GMT

It would be nice if the span=1w of timechart supported week-start modifiers but it does not (please do open an enhancement request). So the only other option is to do as @somesoni2 says, and rewrite _time so that the unchangeable "assume week starts on Monday" thinks that "Tuesday" (or whatever your preference is) is actually "Monday" by adding | eval _time=relative_time(_time, "@wYourNumberHere") before your timechart command.

Re: How to display weekly data starting on a Monday using timecharts?

davidblj — Tue, 29 Sep 2020 21:57:39 GMT

it worked fine to me when i removed the "span=1w", leaving just 'eval _time=relative_time ....'

Re: How to display weekly data starting on a Monday using timecharts?

keiyoshiyama — Wed, 30 Sep 2020 00:35:26 GMT

How about this?(it calculates sunday but it may help)

calculate the week number (0- Sunday, 6-Saturday)
use relative_time() function to do date - weeknumber. it calculates its sunday.
format them to what you like with strftime() function!

source="randomsource.csv"
| eval cr_p_date=strptime(cr_date,"%Y/%m/%d %H:%M")
| eval created_week_num=strftime(cr_p_date,"%w")
| eval created_week_start_p=relative_time(cr_p_date, "-".created_week_num."d@d")
| eval created_week_start=strftime(created_week_start_p, "%m/%d week")
| stats count by created_week_start

Re: How to display weekly data starting on a Monday using timecharts?

keiyoshiyama — Fri, 17 May 2019 06:06:51 GMT

How about this... ( it calculates sunday but it may help.)

convert your time field into epochtime (so that splunk can know that its date)
week number (0, sunday - 6, saturday) can be exploited by strftime([epoch time], "%w")
function relative_time(p_date, "-2d@d") gives minus 2day as result. So if you minus week numberfrom original date, you can get the date which week is same but weekday is 0(sunday.)

hope this helps!

source="some_source.csv"  
| eval p_date=strptime(date,"%Y/%m/%d %H:%M") 
| eval week_num=strftime(p_date,"%w") 
| eval week_start_p=relative_time(p_date, "-".created_week_num."d@d") 
| eval week_start=strftime(week_start_p, "%m/%d week") 
| stats count by created_week_start