Splunk Search
Highlighted

Change X Axis Display to Week Instead of Day

Explorer

I have the x axis of my search displaying by week however I do not want this format:
Apr 23
Apr 30
etc.

I have my chart showing the monthly results and I am trying to achieve something similar to:
Week 1
Week 2
Week 3
Week 4

Thanks!

0 Karma
Highlighted

Re: Change X Axis Display to Week Instead of Day

Champion

Have you tried this out?
|eval weeknumber=strftime(_time,"%U") | stats count by weeknumber

0 Karma
Highlighted

Re: Change X Axis Display to Week Instead of Day

Explorer

Thank you! With a little tweaking, that worked.

0 Karma
Highlighted

Re: Change X Axis Display to Week Instead of Day

Explorer

For anyone in the future who may want to do something similar, here is the search string I used:
....... | eval week=strftime(relativetime(time,"@w1"), "%Y-%m-%d") | stats count by week | streamstats count as weeknum | eval week="Week ".weeknum | fields - weeknum

I had my search time range locked to a month, which worked the nicest (4 weeks in a month).

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.