Dashboards & Visualizations
Highlighted

how to group events per weeknumber ?

Splunk Employee
Splunk Employee

I tried different methods, but couldn't group events per week.
with span=1week, it seems to do a rotating 7 days.

Any way to define the weeknumber in splunk ?

Tags (2)
Highlighted

Re: how to group events per weeknumber ?

Splunk Employee
Splunk Employee

I found a workaround for searches and dashboard is to manually extract them after the search using a strftime

… | eval weeknumber=strftime(_time,"%U") | stats count by weeknumber

To avoid confusions between years, I like to use the year, that help to sort them in chronological order.

… | eval dateyearweek=strftime(_time,"%Y-%U")| stats count by dateyearweek

Depending of your country, you have 2 variations :

  • %U is replaced by the week number of the year (Sunday as the first day of the week) as a decimal number [00,53].
  • %V is replaced by the week number of the year (Monday as the first day of the week) as a decimal number [01,53]. If the week containing 1 January has four or more days in the new year, then it is considered week 1. Otherwise, it is the last week of the previous year, and the next week is week 1.

View solution in original post

Highlighted

Re: how to group events per weeknumber ?

Engager

It may have been "strftime(_time,"%U")" as yannK said.
But in the current Splunk version is the week number defined by "%V"

So, the code snippet should be:

| eval dateyearweek=strftime(_time,"%Y-%V")| stats count by dateyearweek

See Docs for more info. Best Regards!

0 Karma