I’ve been trying to create a yearly/half-yearly/quarterly/monthly/weekly report by using timechart and span command.
Actually most of all Japanese companies' 1st quarter starts from April, so I would like to define original quarter term like as Apr-Jun, Jul-Sep, Oct-Dec,Jan-Mar. Based on this rule, year term also become from Apr to Mar, and half-year term must be from Apr to Sep and from Oct to Mar.
As long as using Splunk function, year starting month seems to be fixed as Jan and cannot be changed.
(Our basic Time Period)
Quarter Apr-Jun etc
(Search command) following commands are not applicable to above requirement.
… | timechart span=1y count as … … | timechart span=6mon count as … … | timechart span=1q count as …
I’ve tried to use following command, but it was not counted from Apr.
earliest=@y4 latest=@y3 | timechart
Do you know the way to change the year starting date from A-Jan to 1-Apr, or if there is a better alternative, please let me know.
Old thread, I know, but here's an answer for anyone looking for this in the future.
Our fiscal year starts in October. I use the following in our DateTime Picker (defined in User Interface > Time Ranges😞
This Fiscal Year: earliest=-3q@y+3q latest=+q@y+3q Previous Fiscal Year: earliest=-y-3q@y+3q latest=-y+q@y+3q
Haven't extensively tested it through a full year's range, but at least on paper it looks good, at least for those instances where the fiscal year boundary corresponds to a quarterly boundary. For This Fiscal Year, the calculation basically is to back up 3 quarters from the current date, snap to the year, and add 3 quarters to it; the latest is to add one quarter to the current date, get the year, and add 3 quarters to that. Previous FY just backs up a year before doing the same calculation.
e.g. #1: Jan 1, 2020, earliest = (Jan 1, 2020 - 3 quarters) = Mar 1, 2019 = snap to 2019 + 3 quarters = Oct 2019
e.g. #2: Sep 30, 2020, earliest = (Sep 30, 2020 - 3 quarters) = Dec 30, 2019 = snap to 2019 + 3 quarters = Oct 2019
Other examples and customizing for your fiscal year boundaries are left to the reader. But do let me know if you find a flaw with this approach!
Thank you for your prompt reply.
Unfortunately, we've not received the expected result, but we could find the appropriate command like as follows
convert TIMEFORMAT="%m" ctime(_time) AS month | eval
month<=12,date_year."年度後期",1=1,"missing") | chart count as "アクセス数" by
half period_search_name usenull=f useother=f
I appreciate your support.
Hi okakizaki [Splunk],
take a look at the docs of
times.conf http://docs.splunk.com/Documentation/Splunk/6.3.2/Admin/Timesconf and get details how to set a custom timerange.
you could use something like this
-y@y+3mon@mon as earliest (will be last year 1st of April) and
-y@y+6mon@mon as latest - adopt as needed.
Hope this helps ...