Getting Data In

Filtering with the week number

taha13
Explorer

Hello,
I have a question: can we do a filtering with the week number
In my dashboard I have filtering on the period (yesterday, last week,last month ...), I want to add in this drop-down list the numbers of the weeks to be able to filtering on it
example: week 1: from the first of January to 07 January

Tags (1)
0 Karma
1 Solution

elliotproebstel
Champion

I think I'm reading your question differently than the others who've answered. It looks to me like you want to be able to add some options into the time filter dropdown to allow users to search for events by week number. The good news: this is possible. The bad news: I don't think it's possible to do this by adding to the regular timepicker. But if you want a dashboard where the time filters are done in a custom dropdown that allows users to select the week, here's a template for doing that:

<form>
  <label>test_timepicker</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="week_timepicker">
      <label>Week</label>
      <choice value="w1">Week 1</choice>
      <choice value="w2">Week 2</choice>
      <choice value="w3">Week 3</choice>
      <change>
        <condition label="Week 1">
          <set token="time_earliest">@y</set>
          <set token="time_latest">@y+1w</set>
        </condition>
        <condition label="Week 2">
          <set token="time_earliest">@y+1w</set>
          <set token="time_latest">@y+2w</set>
        </condition>
        <condition label="Week 3">
          <set token="time_earliest">@y+2w</set>
          <set token="time_latest">@y+3w</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal</query>
          <earliest>$time_earliest$</earliest>
          <latest>$time_latest$</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

You can add to this list of options and make it totally custom - some week options, some day options, etc. The key is to add a <choice> relating to the custom time period you want to specify and then add a <condition> element below that sets both tokens $time_earliest$ and $time_latest$, which are consumed by the panel below running a search. The values you'll use in the <condition> elements will be drawn from this guide: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers

View solution in original post

0 Karma

elliotproebstel
Champion

I think I'm reading your question differently than the others who've answered. It looks to me like you want to be able to add some options into the time filter dropdown to allow users to search for events by week number. The good news: this is possible. The bad news: I don't think it's possible to do this by adding to the regular timepicker. But if you want a dashboard where the time filters are done in a custom dropdown that allows users to select the week, here's a template for doing that:

<form>
  <label>test_timepicker</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="week_timepicker">
      <label>Week</label>
      <choice value="w1">Week 1</choice>
      <choice value="w2">Week 2</choice>
      <choice value="w3">Week 3</choice>
      <change>
        <condition label="Week 1">
          <set token="time_earliest">@y</set>
          <set token="time_latest">@y+1w</set>
        </condition>
        <condition label="Week 2">
          <set token="time_earliest">@y+1w</set>
          <set token="time_latest">@y+2w</set>
        </condition>
        <condition label="Week 3">
          <set token="time_earliest">@y+2w</set>
          <set token="time_latest">@y+3w</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal</query>
          <earliest>$time_earliest$</earliest>
          <latest>$time_latest$</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

You can add to this list of options and make it totally custom - some week options, some day options, etc. The key is to add a <choice> relating to the custom time period you want to specify and then add a <condition> element below that sets both tokens $time_earliest$ and $time_latest$, which are consumed by the panel below running a search. The values you'll use in the <condition> elements will be drawn from this guide: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers

0 Karma

omerl
Path Finder

Just a suggestion - Use @y@w to start from the first day of the week

0 Karma

elliotproebstel
Champion

That will break at week boundaries defined by day of the week, not by Jan1-7, as requested.

0 Karma

FrankVl
Ultra Champion
| eval weeknr=strftime(_time,"%V")

Or use %U or %W depending on which definition of the week numbering you prefer. See also: http://php.net/manual/en/function.strftime.php

skoelpin
SplunkTrust
SplunkTrust

Yes, just add some conditional logic like this

| eval date=strftime(_time,"%d")
| eval week=case(date>0 AND date<8,"week1",date>7 AND date<15,"week2",date>15 AND date<22,"week3",1=1,"week4")
0 Karma

skoelpin
SplunkTrust
SplunkTrust

@taha13 did this work for you?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>