Weekly Trend for a moth and Monthly trend for last 6 months

[pavithra]

I want to show weekly data in a trend ,it should not add total 

Right now using the below query, but it showing overall count of a week

| timechart span=1w@w7 sum(abc) by xyz

@splunk 

[ITWhisperer]

By "weekly data" data, do you mean daily data for the week? If so, you need to timechart by day and set your time period to be the week

| timechart span=1d sum(abc) by xyz

[pavithra]

I want to show data for every monday on weekly basis

[ITWhisperer]

Try something like this

| timechart span=1d sum(abc) by xyz
| where strftime(_time,"%w") = 1

[pavithra]

Its throwing an error 

[ITWhisperer]

Sometimes Splunk is forgiving when it comes to data types, sometimes it isn't - this is one of those!

| timechart span=1d sum(abc) by xyz
| where strftime(_time,"%w") = "1"

[pavithra]

still its not working

[ITWhisperer]

Please share the failing SPL

[pavithra]

Thanks for your response!
I got the query

I index 
| timechart span=1d sum(abc) as total by xyz
| eval day=lower(strftime(_time,"%A"))
| where day=="monday"
| fields - day

[ITWhisperer]

Interesting that you didn't do exactly as I suggested, but this should also work. What exactly is not working?