Splunk Search

How to display weekly data starting on a Monday using timecharts?

Path Finder

I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday?


0 Karma

New Member

How about this... ( it calculates sunday but it may help.)

  1. convert your time field into epochtime (so that splunk can know that its date)
  2. week number (0, sunday - 6, saturday) can be exploited by strftime([epoch time], "%w")
  3. function relative_time(p_date, "-2d@d") gives minus 2day as result. So if you minus week numberfrom original date, you can get the date which week is same but weekday is 0(sunday.)

hope this helps!

| eval p_date=strptime(date,"%Y/%m/%d %H:%M") 
| eval week_num=strftime(p_date,"%w") 
| eval week_start_p=relative_time(p_date, "-".created_week_num."d@d") 
| eval week_start=strftime(week_start_p, "%m/%d week") 
| stats count by created_week_start
0 Karma

New Member

How about this?(it calculates sunday but it may help)

  1. calculate the week number (0- Sunday, 6-Saturday)
  2. use relative_time() function to do date - weeknumber. it calculates its sunday.
  3. format them to what you like with strftime() function!

    | eval cr_p_date=strptime(cr_date,"%Y/%m/%d %H:%M")
    | eval created_week_num=strftime(cr_p_date,"%w")
    | eval created_week_start_p=relative_time(cr_p_date, "-".created_week_num."d@d")
    | eval created_week_start=strftime(created_week_start_p, "%m/%d week")
    | stats count by created_week_start

0 Karma

Esteemed Legend

It would be nice if the span=1w of timechart supported week-start modifiers but it does not (please do open an enhancement request). So the only other option is to do as @somesoni2 says, and rewrite _time so that the unchangeable "assume week starts on Monday" thinks that "Tuesday" (or whatever your preference is) is actually "Monday" by adding | eval _time=relative_time(_time, "@wYourNumberHere") before your timechart command.

0 Karma

Revered Legend

Try adding this before your timechart command.

| eval _time=relative_time(_time,"@w1") | timechart span=1w ....
0 Karma


it worked fine to me when i removed the "span=1w", leaving just 'eval _time=relative_time ....'

0 Karma

Path Finder

Hmm this still starts it on a Thursday. If i change the number to, say, "@w4" or "@w5" it just skips to the following Thursday.

0 Karma

Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...