I have set up an accelerated summary for a report with summary range of 1 month. I want to report summary by week. When I run a search with "timechart bins=4 span=1week...", I get 4 to 5 bins: one per week. But then I also get some other bins with days in addition to weekly bins in my search results. I don't want to get individual days that are outside the week boundaries. I never want to see data summarized by any granularity lower than a week. Do I need to change my acceleration setup or my timechart command in the search?
Splunk doc says to let them figure out the correct timespan. But I feel that they are summarizing at too low of a granular level (10min, 1hr). Regardless, I want the timechart command to show correct results with proper weekly bins.
What is wrong here?
Here is how my summary detail looks:
Details Learn more.
Summarization Load 0.0000
Access Count 0 Last Access: Never
Size on Disk 7.83MB
Summary Range 30 days
Timespans 10min, 1d, 1h, 1mon
Do post the entire search you're running, over what time range, and what results you're getting in the statistics tab.
bucketing yourself, like this, just before your
... | eval _time = case((tonumber(strftime(_time, "%d")) <= 7), "1", (tonumber(strftime(_time, "%d")) <= 14), "2", (tonumber(strftime(_time, "%d")) <= 21), "3", (tonumber(strftime(_time, "%d")) <= 28), "4", true(), "5")
Thank you @woodcock. This worked. I further modified it as follows to snap _time to the beginning of the week (Sunday):
| eval _time = strftime(relative_time(_time, "-0w@w"),"%Y-%m-%d") | stats count as events by _time
Although, I am somewhat disappointed that timechart is not working as expected with its "span" and "bins" options. Anyway, thank you very much for your help!!