Splunk Search

Change x axis _time display to weekly instead of daily

link22
Explorer

So I'm aiming for a month's worth of data to be displayed as "Week 1, Week 2, Week 3, Week 4" instead of by "Apr 13, Apr 30, etc."

I've been formatting both my XML and search string but to no avail. Any suggestions?

0 Karma
1 Solution

renjith_nair
Legend

You could either use the calendar week %V

your search | eval week=strftime(_time,"%V") |stats count by week

Or

your search|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")|stats count by week

or if you want to specifically display week number then,

your search|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")|stats count by week|streamstats count as weeknum|eval week="Week".weeknum|fields - weeknum
Happy Splunking!

View solution in original post

renjith_nair
Legend

You could either use the calendar week %V

your search | eval week=strftime(_time,"%V") |stats count by week

Or

your search|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")|stats count by week

or if you want to specifically display week number then,

your search|eval week=strftime(relative_time(_time,"@w1"),"%Y-%m-%d")|stats count by week|streamstats count as weeknum|eval week="Week".weeknum|fields - weeknum
Happy Splunking!

renjith_nair
Legend

@link22, does it work for you?

Happy Splunking!
0 Karma

link22
Explorer

It did! Thank you so much, you really helped me a lot!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...