I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday
For example.
_time | Count |
2020-11-28 | 164 |
2020-12-05 | 488 |
2020-12-12 | 516 |
2020-12-26 | 5755 |
2021-01-02 | 482 |
2021-01-09 | 450 |
2021-01-16 | 1274 |
2021-01-23 | 33684 |
Expected Output is :
With two weeks time span I want to display the counts as below
Four weeks before (164+488+516+5755)
Two weeks before (450+482)
Latest two weeks 34958 ( which is count of 2021-01-16 and 2021-01-23 1274 + 33684)
I found a solution but let me know if anyone has any better solution
index="my index" | where <condition>
| timechart span=1w@w6 count as eachwcount
| eval latest_2weeks=relative_time(now(),"-1w@w6")
| eval two_weeks_before = relative_time(now(),"-3w@w6")
| eval four_weeks_before = relative_time(now(),"-5w@w6")
| eval weeksAgo=case(_time < two_weeks_before, "Four_Weeks_Before", _time >= two_weeks_before and _time < latest_2weeks," Two_Weeks_Before",_time >= latest_2weeks,"Latest_Two_Weeks")
| stats sum(eachwcount) as totalcount by weeksAgo