index=_internal source=license_usage.log type=Usage earliest=-4w@w | eval tdw=upper(strftime(now(),"%A")) | eval cdw=upper(strftime(_time,"%A")) | where cdw==tdw | timechart span=1day sum(b) AS volume_b by idx
Adding the earliest clause limits you to the last four weeks of data. The first eval clause computes today's day of the week. The second eval clause computes the day of the week for each event. Finally, the where clause compares the two and filters out data that doesn't match.