Dashboards & Visualizations

Weekly Chart

Chinmai
Explorer

Hi Guys,

I have a requirement where i need to have time chart of count of tickets by priorities(p1,p2,p3,p4). Timechart should be a stacked bar chart with data showing for every week(mon-sun). Like one stacked bar should be the total count of tickets from this monday to till now and next point should show the total count of tickets from last monday to last sunday(basically total count of tickets for every monday to sunday). chart should show data for last 4/5 weeks. I am finding difficult to create data for every monday to sunday.

Can anyone help me with this?

Many Thanks in advance.

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion
index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")
| chart count by week Priority | tail 5

try that and let me know if it works.

View solution in original post

0 Karma

cmerriman
Super Champion
index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")
| chart count by week Priority | tail 5

try that and let me know if it works.

0 Karma

Chinmai
Explorer

Yes it works!!. Thank you so Much:)

0 Karma

cmerriman
Super Champion

can you show syntax/data examples that you have so far?

to get weekly snapshots, use |eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d") and that will give you the date of the Monday the week started on.

0 Karma

Chinmai
Explorer

index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time
| timechart count span=7d by Priority| sort _time | tail 5 | sort _time | rename _time as Time | eval Time=strftime(Time,"%Y-%m-%d").

This is my current query which shows count for every 7 days, but I need count for every Monday to Sunday. is that possible?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...