Weekly Chart

[Chinmai]

Hi Guys,

I have a requirement where i need to have time chart of count of tickets by priorities(p1,p2,p3,p4). Timechart should be a stacked bar chart with data showing for every week(mon-sun). Like one stacked bar should be the total count of tickets from this monday to till now and next point should show the total count of tickets from last monday to last sunday(basically total count of tickets for every monday to sunday). chart should show data for last 4/5 weeks. I am finding difficult to create data for every monday to sunday.

Can anyone help me with this?

Many Thanks in advance.

[cmerriman · Accepted solution]

index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")
| chart count by week Priority | tail 5

try that and let me know if it works.

[Chinmai]

Yes it works!!. Thank you so Much:)

[cmerriman]

can you show syntax/data examples that you have so far?

to get weekly snapshots, use |eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d") and that will give you the date of the Monday the week started on.

[Chinmai]

index="abc" sourcetype="incidents" Priority!="Priority" latest=now| stats latest(State) as State, latest(Priority) as Priority by Number _time
| timechart count span=7d by Priority| sort _time | tail 5 | sort _time | rename _time as Time | eval Time=strftime(Time,"%Y-%m-%d").

This is my current query which shows count for every 7 days, but I need count for every Monday to Sunday. is that possible?