I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday?
Thanks,
Sam
How about this... ( it calculates sunday but it may help.)
strftime([epoch time], "%w")
relative_time(p_date, "-2d@d")
gives minus 2day as result. So if you minus week number
from original date, you can get the date which week is same but weekday is 0(sunday.)hope this helps!
source="some_source.csv"
| eval p_date=strptime(date,"%Y/%m/%d %H:%M")
| eval week_num=strftime(p_date,"%w")
| eval week_start_p=relative_time(p_date, "-".created_week_num."d@d")
| eval week_start=strftime(week_start_p, "%m/%d week")
| stats count by created_week_start
How about this?(it calculates sunday but it may help)
relative_time()
function to do date - weeknumber
. it calculates its sunday. format them to what you like with strftime()
function!
source="randomsource.csv"
| eval cr_p_date=strptime(cr_date,"%Y/%m/%d %H:%M")
| eval created_week_num=strftime(cr_p_date,"%w")
| eval created_week_start_p=relative_time(cr_p_date, "-".created_week_num."d@d")
| eval created_week_start=strftime(created_week_start_p, "%m/%d week")
| stats count by created_week_start
It would be nice if the span=1w
of timechart
supported week-start modifiers but it does not (please do open an enhancement request). So the only other option is to do as @somesoni2 says, and rewrite _time
so that the unchangeable "assume week starts on Monday" thinks that "Tuesday" (or whatever your preference is) is actually "Monday" by adding | eval _time=relative_time(_time, "@wYourNumberHere")
before your timechart
command.
Try adding this before your timechart command.
| eval _time=relative_time(_time,"@w1") | timechart span=1w ....
it worked fine to me when i removed the "span=1w", leaving just 'eval _time=relative_time ....'
Hmm this still starts it on a Thursday. If i change the number to, say, "@w4" or "@w5" it just skips to the following Thursday.