How to display weekly data starting on a Monday using timecharts?

[samwatson45]

I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday?

Thanks,
Sam

[keiyoshiyama]

How about this... ( it calculates sunday but it may help.)

1. convert your time field into epochtime (so that splunk can know that its date)
2. week number (0, sunday - 6, saturday) can be exploited by strftime([epoch time], "%w")
3. function relative_time(p_date, "-2d@d") gives minus 2day as result. So if you minus week numberfrom original date, you can get the date which week is same but weekday is 0(sunday.)

hope this helps!

source="some_source.csv"  
| eval p_date=strptime(date,"%Y/%m/%d %H:%M") 
| eval week_num=strftime(p_date,"%w") 
| eval week_start_p=relative_time(p_date, "-".created_week_num."d@d") 
| eval week_start=strftime(week_start_p, "%m/%d week") 
| stats count by created_week_start

[keiyoshiyama]

How about this?(it calculates sunday but it may help)

1. calculate the week number (0- Sunday, 6-Saturday)
2. use relative_time() function to do date - weeknumber. it calculates its sunday.

3. format them to what you like with strftime() function!

   source="randomsource.csv"
   | eval cr_p_date=strptime(cr_date,"%Y/%m/%d %H:%M")
   | eval created_week_num=strftime(cr_p_date,"%w")
   | eval created_week_start_p=relative_time(cr_p_date, "-".created_week_num."d@d")
   | eval created_week_start=strftime(created_week_start_p, "%m/%d week")
   | stats count by created_week_start

[woodcock]

It would be nice if the span=1w of timechart supported week-start modifiers but it does not (please do open an enhancement request). So the only other option is to do as @somesoni2 says, and rewrite _time so that the unchangeable "assume week starts on Monday" thinks that "Tuesday" (or whatever your preference is) is actually "Monday" by adding | eval _time=relative_time(_time, "@wYourNumberHere") before your timechart command.

[somesoni2]

Try adding this before your timechart command.

| eval _time=relative_time(_time,"@w1") | timechart span=1w ....

[davidblj]

it worked fine to me when i removed the "span=1w", leaving just 'eval _time=relative_time ....'

[samwatson45]

Hmm this still starts it on a Thursday. If i change the number to, say, "@w4" or "@w5" it just skips to the following Thursday.

[adonio]

see here:
https://answers.splunk.com/answers/562033/why-is-time-chart-with-span-of-1w-always-thursday.html