I am running a search for last 7 days results, and i am using fixed_date field as _time field.
fixed_date can have any value in last 1 year, so I filtering for results of last 6 months. I want the weekly results to show for every Monday. Below query shows results for last 2 Mondays, but then it pickup Thursday.
index=abcd sourcetype=abcd (IP=x.x.x.x OR IP=y.y.y.y)
| eval _time=strptime(fixed_date,"%Y-%m-%d")
| where _time > relative_time(now(), "-6mon")
| bin _time span=w@w1
| stats count by IP ID _time
| stats count as "Fixed vulnerabilities" by _time
Results I get:
_time Fixed vulnerabilities
....<few weekly results for total 6 months>
Only last 2 are Mondays, but all before those are Thursdays. how to get it for every Monday?