trying to get a monthly report

[wye054]

Hi ,

I am trying to get an monthly report, where the x axis will represent week 1 , week 2 , week 3 and 4 and y axis for transaction.my requirement is suppose week 1 starts from 1stJan'2014 then
in the report it should be like on column 1stjan to 7th Jan , 2nd one from 8thJan 14th janetc , but in my case i am able to see only 1st jan, 8th jan , 15th jan etc, i am using
sourcetype="*Ledf.log" tid|rex field=_raw "\stid((?\d+)"|dedup tid | eval status = if(error == 200, "OK", "Error")| timechart count as Trans span=7D
| eval date=strftime(_time, "%x")

can somebody help me on this

[richgalloway]

If I understand correctly, you want each column of the chart to have start and end dates. Isn't the end date of a column implied by the start date of the next column? Having the extra dates would only make the X-axis label harder to read.

[linu1988]

why don't you try this?

sourcetype="*Ledf.log" tid|rex field=_raw "stid((?<tid>d+)"|dedup tid |bucket _time span=1w | eval status = if(error == 200, "OK", "Error")| timechart count as Trans

Or if you want to show the dates directly then you need to use the stats command to extract the date and time of the year then make a chart rather than a timechart

sourcetype="*Ledf.log" tid|rex field=_raw "stid((?<tid>d+)"|dedup tid |bucket _time span=1w|eval TimeStamp=strftime(_time,"%A %d/%m/%Y") | eval status = if(error == 200, "OK", "Error")|chart count as Trans by TimeStamp

[wye054]

Yes you are right . But could you please tell me how to get the enddate in the column ..