Hi,
I am using the below search to display the average transactions by day over a couple weeks. I need the days to show in chronological order. I have seen the Splunk Documentation, and I am still not able to figure it out. Any advice will be beneficial:
index=XXX sourcetype=XXXXX
| timechart span=1h dc(transactionID) as transactions
| eval weekday=strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| chart avg(transactions) as transactions by hour, weekday
Give this a try
index=XXX sourcetype=XXXXX
| timechart span=1h dc(transactionID) as transactions
| eval weekday=strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| chart avg(transactions) as transactions by hour, weekday
| table hour Sunday Monday Tuesday Wednesday Thursday Friday Saturday
Give this a try
index=XXX sourcetype=XXXXX
| timechart span=1h dc(transactionID) as transactions
| eval weekday=strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| chart avg(transactions) as transactions by hour, weekday
| table hour Sunday Monday Tuesday Wednesday Thursday Friday Saturday
This worked! Thank you!
@cwhurd1
Can you please try below search?
index=XXX sourcetype=XXXXX
| timechart span=1h dc(transactionID) as transactions
| eval weekday=strftime(_time,"%w")."_".strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| chart avg(transactions) as transactions by hour, weekday
| rename 1_* as *,2_* as *,3_* as *,4_* as *,5_* as *,6_* as *,0_* as *
My Sample Search:
index=*
| timechart span=1h count as transactions
| eval weekday=strftime(_time,"%w")."_".strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| chart avg(transactions) as transactions by hour, weekday | rename 1_* as *,2_* as *,3_* as *,4_* as *,5_* as *,6_* as *,0_* as *
Here we know Splunk displays column name in alphabetical order, so I have provided day number as initial character of weekday and then renamed it.
thanks
This did not work for me. It returned the same results.
@kamlesh_vaghela this will fail if Selected Time spans across multiple weeks as stated in the question 😉
%w (Week day from 0-6) and %A (Week day from Sunday- Saturday) will match for same days of the week so they will appear next to each other.