Change timechart x-axis to quarters?

[POR160893]

Hi,

I have a timechart and the timeline on the X-axis must be in terms of quarters, i.e. like FY24Q1, FY24 Q2 etc.

Currently, this is my query:
(BASE SEARCH) | timechart span=1q count | eval Quarter=strftime(_time,"%Y") . "Q" . ceil((strftime(_time,"%m")+1)/3) | rename count as "Event Count" | fields Quarter, "Event Count"

However, I am receiving the following error:
Error in 'eval' command: Type checking failed. '+' only takes two strings or two numbers.

What can I do to solve this?


Thanks as always!

[richgalloway]

The strftime function returns a string.  The error is complaining that eval can't add a number to a string.  Try this to convert the strftime output to a number.

| eval Quarter=strftime(_time,"%Y") . "Q" . ceil(tonumber(strftime(_time,"%m")))+1/3)

[POR160893]

When I used your suggestion as follows:
[BASE SEARCH]
| timechart span=1q count
| eval Quarter=strftime(_time,"%Y") . "Q" . ceil(tonumber(strftime(_time,"%m"))+1)/3)
| rename count as "Event Count" | fields Quarter, "Event Count",

I receive the following error:
Error in 'eval' command: The expression is malformed.

What can I do?

[richgalloway]

I misplaced a parenthesis.  Please try my revised answer.

[POR160893]

So, at the moment, your updated query gives me this:

The above query is as follows:
[BASE SEARCH]
| timechart span=1q count
| eval Quarter=strftime(_time,"%Y") . "Q" . ceil((tonumber(strftime(_time,"%m")))+1/3)
| rename count as "Event Count" | fields Quarter, "Event Count"

However, I need the individual days to be show WITH what ever quarter the day falls in.. So one timeline whose Year/Month/date and an overarching time to show what Quarter it falls.
Is this possible?

[richgalloway]

Timecharts support a single timeline on the X-axis.  Consider filing an enhancement request at https://ideas.splunk.com

Another thing to consider is using annotations to denote the quarters.  An annotation is a vertical line in the graph that marks when something happened.  It's not exactly what you're looking for, but may help.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartEventAnnotations for more information.