Splunk Search

How to display a year's data on a quarterly basis, and define which months are considered for each quarter?

Path Finder

Hi Team,

I have data for the year 2016. I want to display the data on a quarterly basis, and I want to customize the duration for each quarter, like 2016 DEC- 2017 Feb as one quarter and 2017 March to 2017 June as one quarter etc.

Can you please let me know, how this can be achieved?

I googled and got this query, but not sure how this will work.

 |eval period=strftime(_time,"%Y")."-Q".(round(tonumber(strftime(_time,"%m"))/3)+ 1)
Tags (3)
0 Karma


There are lots of ways, but I'm not sure what you meant in your "customize the duration of each quarter", since your second example is four months long.

If you want to do that, having quarters that are not, in the mathematical or accounting sense, three months long, then your best bet is to create a lookup table and look up the fiscal quarter that way.

2016-12   2017-Q1
2017-01   2017-Q1
2017-02   2017-Q1
2017-03   2017-Q2
2017-04   2017-Q2
2017-05   2017-Q2
2017-06   2017-Q2
2017-07   2017-Q3

You could also go one step further and have the beginning and ending day-dates in your lookup table, in case, for example, you were trying to map a lunar calendar (Islamic or Jewish or whatever) onto a western quarterly fiscal reporting structure.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>