Below is the data. Weeknum is the number of week where 01-05 are week numbers from 2019 and 40-44 are week numbers from 2018. I want to generate a chart for the same data with x-axis as the first date of each week number. Ex- 40 should be Oct 1, 2018 and 01 should be 30/12/2018. How do I do it?
week Total
01 3
02 2
03 1
04 1
05 3
40 4
41 9
42 4
43 5
44 10
@nikita012 please try one of my older answers https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html
Following is the code:-
| eval Dates=strptime(Date, "%m/%d/%Y")
| sort Dates
| eval Dates=strftime(Dates, "%d/%m/%Y")
| eval weeknum=strftime(relative_time(strptime(Dates,"%d/%m/%Y"),"@w2"),"%Y/%V")
| stats min(_time) as MinTime by weeknum
| eval MinTime=strftime(MinTime,"%m/%d/%Y")
| eval WeekStartDate=strftime(relative_time(strptime(MinTime,"%m/%d/%Y"),"-0w@w"),"%m/%d/%Y")
This code is not giving the start date of each weeknum. 2018/39 should be 01/10/2018. It's taking the start date of the current week. How should I reslove it?
@nikita012 please try one of my older answers https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html
@nikita012 I am not sure how the post does not help with your current query?
Following is a run anywhere example which converts your time format data %Y/%U
to %m/%d/%Y
index=_internal sourcetype=splunkd log_level!=ERROR component=Exec*
| eval WeekOfYear=strftime(_time,"%Y/%U")
| stats count as Errors min(_time) as MinTime by WeekOfYear
| eval MinTime=strftime(MinTime,"%m/%d/%Y")
| eval WeekStartDate=strftime(relative_time(strptime(MinTime,"%m/%d/%Y"),"-0w@w"),"%m/%d/%Y")
| table WeekStartDate Errors