Divide by quarter

[appleman]

Hello,

In my search, I configured time as the following format %Y%m to see the trends every month over a year.
If I want to count by quarter since I can't see the time(date) how do I define it? (timerange is set "alltime")
Additionally, if it's possible, I want to add a custom timerange picker to pick each quarter, so I want to know if I can do it in splunk 6 dashboard.

Thank you.

---

「年/月」と定義した時間をタイムチャートで表示した時、情報量が多くて時間が隠れてしまいます。
これをクウォーターごとに区切ってカウントしたい場合はサーチ文で分割することは可能でしょうか。タイムレンジは傾向が見たいので、なるべく全時間をしても綺麗に結果が出せるようにしたいです。

尚、クウォーターが選択できるカスタムタイムレンジピッカーをsplunk6で作成する方法はございますでしょうか。

My search: index=mdm source=*idm_device cid=* | eval enrolled=strftime(enrolled_date, "%Y/%m") | chart count by enrolled_type

[eashwar]

Hello Brother,

Its very simple and straight forward

| timechart span=qtr count by enrolled_type

If you need to view a report for exactly last 6 quarters

in the advance time range set the below

earliest=-6qtr@qtr latest=-qtr@qtr

Thanks, and Happy splunking bro !!

Vote for the answer if it really helps you, thanks again

[somesoni2 · Accepted solution]

Try this

index=mdm source=*idm_device cid=* | eval enrolled=strftime(enrolled_date,"%Y")."-Q".(round(tonumber(strftime(enrolled_date,"%m"))/3)+ 1) | chart count by enrolled

[appleman]

I've got this result. Unfortunately, this is not what I want....

[appleman]

Yes, that's correct.

[melonman]

Oh, that's because there is no data? so you have data for 2011 - 2012 but there is no result for timechart span=3mon count?

[appleman]

The result above is missing 2011 through 2012 data while I could see them if I didn't divide by span=3mon.
And what I want to try most is show x axis as like "2011-Q1", "2011-Q2".... and so on.

[melonman]

how would you like to display? could you help me understand?

[appleman]

I've got this result. Unfortunately, this is not what I want....

[melonman]

Could you try this?

<your filter search> | timechart span=3mon count by enrolled_type