Dashboards & Visualizations

Weekly Chart

Chinmai
Explorer

Hi Guys,

I have a requirement where i need to have time chart of count of tickets by priorities(p1,p2,p3,p4). Timechart should be a stacked bar chart with data showing for every week(mon-sun). Like one stacked bar should be the total count of tickets from this monday to till now and next point should show the total count of tickets from last monday to last sunday(basically total count of tickets for every monday to sunday). chart should show data for last 4/5 weeks. I am finding difficult to create data for every monday to sunday.

Can anyone help me with this?

Many Thanks in advance.

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion
index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")
| chart count by week Priority | tail 5

try that and let me know if it works.

View solution in original post

0 Karma

cmerriman
Super Champion
index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")
| chart count by week Priority | tail 5

try that and let me know if it works.

0 Karma

Chinmai
Explorer

Yes it works!!. Thank you so Much:)

0 Karma

cmerriman
Super Champion

can you show syntax/data examples that you have so far?

to get weekly snapshots, use |eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d") and that will give you the date of the Monday the week started on.

0 Karma

Chinmai
Explorer

index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time
| timechart count span=7d by Priority| sort _time | tail 5 | sort _time | rename _time as Time | eval Time=strftime(Time,"%Y-%m-%d").

This is my current query which shows count for every 7 days, but I need count for every Monday to Sunday. is that possible?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...