Reporting

Split a Report in Weeks

Oti47
Path Finder

Hello,
I'd like to split a Report in Weeks.
I use a time chart report with span=1week, but the y-axis display the first day of a week.

XXX | timechart span=1week sum(NWert) AS Umsatz

How could i change the display of the x-axis in Weeks like this 22, 23, 24, 25?

Thanks
Oti

Tags (1)
1 Solution

echalex
Builder

Hi Oti47,

Rather than using timechart, use chart by week. You'll get the weeknumber from strftime:

XXX | eval week=strftime(_time,"%V") |chart sum(NWert) AS umsatz by week

HTH,

View solution in original post

echalex
Builder

Glad it worked. Feel free to accept the answer as the correct one, so others can see it's solved.

0 Karma

Oti47
Path Finder

Thanks.

Works for me.

0 Karma

echalex
Builder

Hi Oti47,

Rather than using timechart, use chart by week. You'll get the weeknumber from strftime:

XXX | eval week=strftime(_time,"%V") |chart sum(NWert) AS umsatz by week

HTH,

echalex
Builder

Note!

This works for the ISO 8601 standard, where a week starts on Monday and the first week of the year is the first to have at least four days of the new year in it. Iow. if 1st Jan is on a Friday, its week number is 53 of the last week.

Users who would like to have the week starting on a Sunday, should consider using %U rather than %V.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...