https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62780#M15496 <P>relative_time() - Works perfect! Thanks.</P> Wed, 30 May 2012 14:25:00 GMT aarcro 2012-05-30T14:25:00Z https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62778#M15494 <P>So I want use bucket to group my data by weeks that start on Mondays if I change my query to use <CODE>earliest=-1w@w1 latest=@w1</CODE> Then <CODE>bucket span=week</CODE> does the right thing. But I'm going to be running a daily (or hourly) summary index, that I want to bucket by weeks including the current week in progress.</P> <P>Index:</P> <PRE><CODE>sourcetype="source" | bucket _time span=day | stats count by severity, customer, _time </CODE></PRE> <P>Search that works for daily counts</P> <PRE><CODE>search severity &gt; 9 customer="name" | eval Day=strftime(_time, "%Y-%m-%d")| eval n="count" | xyseries Day, n, count </CODE></PRE> <P>I need a search that works for weekly counts snapped to mondays.</P> Tue, 29 May 2012 21:15:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62778#M15494 aarcro 2012-05-29T21:15:05Z https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62779#M15495 <P>How does this work for you?</P> <PRE><CODE>search severity &gt; 9 customer="name" | eval Week=relative_time(_time, "@w1") | eval n="count" | xyseries Week, n, count </CODE></PRE> Wed, 30 May 2012 08:08:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62779#M15495 lguinn2 2012-05-30T08:08:51Z https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62780#M15496 <P>relative_time() - Works perfect! Thanks.</P> Wed, 30 May 2012 14:25:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62780#M15496 aarcro 2012-05-30T14:25:00Z https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62781#M15497 <P>Actually need to run through stats again to sum(count) by Week</P> Wed, 30 May 2012 14:49:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62781#M15497 aarcro 2012-05-30T14:49:46Z https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62782#M15498 <P>search severity &gt; 9 customer="name" | <BR /> eval Week=relative_time(_time, "@w1") |<BR /><BR /> stats count by severity customer Week |<BR /> eval n="count" | <BR /> xyseries Week, n, count</P> <P>though I am unclear on why you want count by severity and customer as well as by week...</P> Mon, 28 Sep 2020 11:53:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-snap-span-with-bucket/m-p/62782#M15498 lguinn2 2020-09-28T11:53:30Z