Splunk Search

Change X Axis Display to Week Instead of Day

link22
Explorer

I have the x axis of my search displaying by week however I do not want this format:
Apr 23
Apr 30
etc.

I have my chart showing the monthly results and I am trying to achieve something similar to:
Week 1
Week 2
Week 3
Week 4

Thanks!

0 Karma
1 Solution

link22
Explorer

For anyone in the future who may want to do something similar, here is the search string I used:
....... | eval week=strftime(relative_time(_time,"@w1"), "%Y-%m-%d") | stats count by week | streamstats count as weeknum | eval week="Week ".weeknum | fields - weeknum

I had my search time range locked to a month, which worked the nicest (4 weeks in a month).

View solution in original post

0 Karma

link22
Explorer

For anyone in the future who may want to do something similar, here is the search string I used:
....... | eval week=strftime(relative_time(_time,"@w1"), "%Y-%m-%d") | stats count by week | streamstats count as weeknum | eval week="Week ".weeknum | fields - weeknum

I had my search time range locked to a month, which worked the nicest (4 weeks in a month).

0 Karma

Sukisen1981
Champion

Have you tried this out?
|eval weeknumber=strftime(_time,"%U") | stats count by weeknumber

0 Karma

link22
Explorer

Thank you! With a little tweaking, that worked.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...