Hi Everyone,
I want to plot a chart according to the calendar week. I plotted a timechart like this,
|timechart span=7d distinct_count(Task_num) as Tasks by STATUS
But this doesn't give the exact calendar weeks. Also i am keeping this charts data to last 3 months.
Anyone have idea how to plot a bar chart based on calendar week? instead of date i want to see the data for current calendar weeks of last 3 months.
I got from the splunk community on how to get the Calendar week. But i am not to plot a graph out of it.
| eval weeknum=strftime(strptime(yourdatefield,"%d-%m-%Y"),"%V")
_time is already in epoch form so it does not need to be (and cannot be) converted using strptime.
| eval weeknum=strftime(_time, "%V")
| chart dc(Task_num) as Tasks over weeknum by STATUS
Hi
maybe you could try to get data by adding this into your base search ?
earliest=-3mon@w+d latest=@w+d
Untested, but try the chart command.
| eval weeknum=strftime(strptime(yourdatefield,"%d-%m-%Y"),"%V")
| chart dc(Task_num) as Tasks over weeknum by STATUS
Mt date field is _time. When i use this query i'm getting as no results found.
| eval weeknum=strftime(strptime(_time,"%d-%m-%Y"),"%V")
| chart dc(Task_num) as Tasks over weeknum by STATUS
_time is already in epoch form so it does not need to be (and cannot be) converted using strptime.
| eval weeknum=strftime(_time, "%V")
| chart dc(Task_num) as Tasks over weeknum by STATUS
Hi @richgalloway ,
Is it possible to sort this according to the year? My search query i have set for last 3 months data, it is taking last years data. But in chart the calendar week 48,49 etc are coming at the end. But they should be in the beginning. I am trying out some solutions but not able to do it properly. Do you know any suggestion for this?
Numbers always sort in numerical order. To change the order, change the numbers by adding the year to them.
| eval weeknum=strftime(_time, "%y-%V")
| chart dc(Task_num) as Tasks over weeknum by STATUS
Hi @richgalloway , i added the year and it is working fine now. I want to only show the calendar week in the chart, any solution for this?
What i understand is that we cannot change the labels.
It is true one cannot change the labels. That means we have to choose between having week numbers in numerical rather than calendar order or having year-week numbers in calendar order.
Thank you so much.. I totally forgot that it is already in epoch format.