I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday?
How about this... ( it calculates sunday but it may help.)
strftime([epoch time], "%w")
relative_time(p_date, "-2d@d")gives minus 2day as result. So if you minus
week numberfrom original date, you can get the date which week is same but weekday is 0(sunday.)
hope this helps!
source="some_source.csv" | eval p_date=strptime(date,"%Y/%m/%d %H:%M") | eval week_num=strftime(p_date,"%w") | eval week_start_p=relative_time(p_date, "-".created_week_num."d@d") | eval week_start=strftime(week_start_p, "%m/%d week") | stats count by created_week_start
How about this?(it calculates sunday but it may help)
relative_time()function to do
date - weeknumber. it calculates its sunday.
format them to what you like with
| eval cr_p_date=strptime(cr_date,"%Y/%m/%d %H:%M")
| eval created_week_num=strftime(cr_p_date,"%w")
| eval created_week_start_p=relative_time(cr_p_date, "-".created_week_num."d@d")
| eval created_week_start=strftime(created_week_start_p, "%m/%d week")
| stats count by created_week_start
It would be nice if the
timechart supported week-start modifiers but it does not (please do open an enhancement request). So the only other option is to do as @somesoni2 says, and rewrite
_time so that the unchangeable "assume week starts on Monday" thinks that "Tuesday" (or whatever your preference is) is actually "Monday" by adding
| eval _time=relative_time(_time, "@wYourNumberHere") before your
Try adding this before your timechart command.
| eval _time=relative_time(_time,"@w1") | timechart span=1w ....
it worked fine to me when i removed the "span=1w", leaving just 'eval _time=relative_time ....'
Hmm this still starts it on a Thursday. If i change the number to, say, "@w4" or "@w5" it just skips to the following Thursday.