Hello,
I couldn't find sufficient solution at documentation nor community.
I have to setup timechart, where span=1w, to start at particular day: Monday 00:00.
The query looks like this (I am sorry, I had to anonymity sensitive information):
index=XXX sourcetype= YYY
| eval Alrt_lvl = B_Lvl + Prio_diff
| timechart span=1w count(Alrt_lvl) by Alrt_lvl
Kindly please advise.
Your advise helped, but with a bit modification. Simple:
| timechart span=1w@w1
works.
Thank you!!!
Hi @JacobWrdz,
there's a workaround that should run but I never tested,
index=XXX sourcetype= YYY
| eval Alrt_lvl = B_Lvl + Prio_diff, _time = relative_time(_time,"@w0")
| timechart span=1w count(Alrt_lvl) by Alrt_lvl
Ciao.
Giuseppe
Your advise helped, but with a bit modification. Simple:
| timechart span=1w@w1
works.
Thank you!!!