Solved: Re: Split a Report in Weeks - Splunk Community

Reporting

Hello,
I'd like to split a Report in Weeks.
I use a time chart report with span=1week, but the y-axis display the first day of a week.

XXX | timechart span=1week sum(NWert) AS Umsatz

How could i change the display of the x-axis in Weeks like this 22, 23, 24, 25?

Thanks
Oti

1 Solution

Solution

Hi Oti47,

Rather than using timechart, use chart by week. You'll get the weeknumber from strftime:

XXX | eval week=strftime(_time,"%V") |chart sum(NWert) AS umsatz by week

HTH,

View solution in original post

Glad it worked. Feel free to accept the answer as the correct one, so others can see it's solved.

Thanks.

Works for me.

Solution

Hi Oti47,

Rather than using timechart, use chart by week. You'll get the weeknumber from strftime:

XXX | eval week=strftime(_time,"%V") |chart sum(NWert) AS umsatz by week

HTH,

Note!

This works for the ISO 8601 standard, where a week starts on Monday and the first week of the year is the first to have at least four days of the new year in it. Iow. if 1st Jan is on a Friday, its week number is 53 of the last week.

Users who would like to have the week starting on a Sunday, should consider using %U rather than %V.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...