Splunk Search

How to display weekly data starting on a Monday using timecharts?

Path Finder

I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday?

Thanks,
Sam

0 Karma

New Member

How about this... ( it calculates sunday but it may help.)

  1. convert your time field into epochtime (so that splunk can know that its date)
  2. week number (0, sunday - 6, saturday) can be exploited by strftime([epoch time], "%w")
  3. function relative_time(p_date, "-2d@d") gives minus 2day as result. So if you minus week numberfrom original date, you can get the date which week is same but weekday is 0(sunday.)

hope this helps!

source="some_source.csv"  
| eval p_date=strptime(date,"%Y/%m/%d %H:%M") 
| eval week_num=strftime(p_date,"%w") 
| eval week_start_p=relative_time(p_date, "-".created_week_num."d@d") 
| eval week_start=strftime(week_start_p, "%m/%d week") 
| stats count by created_week_start
0 Karma

New Member

How about this?(it calculates sunday but it may help)

  1. calculate the week number (0- Sunday, 6-Saturday)
  2. use relative_time() function to do date - weeknumber. it calculates its sunday.
  3. format them to what you like with strftime() function!

    source="randomsource.csv"
    | eval cr_p_date=strptime(cr_date,"%Y/%m/%d %H:%M")
    | eval created_week_num=strftime(cr_p_date,"%w")
    | eval created_week_start_p=relative_time(cr_p_date, "-".created_week_num."d@d")
    | eval created_week_start=strftime(created_week_start_p, "%m/%d week")
    | stats count by created_week_start

0 Karma

Esteemed Legend

It would be nice if the span=1w of timechart supported week-start modifiers but it does not (please do open an enhancement request). So the only other option is to do as @somesoni2 says, and rewrite _time so that the unchangeable "assume week starts on Monday" thinks that "Tuesday" (or whatever your preference is) is actually "Monday" by adding | eval _time=relative_time(_time, "@wYourNumberHere") before your timechart command.

0 Karma

SplunkTrust
SplunkTrust

Try adding this before your timechart command.

| eval _time=relative_time(_time,"@w1") | timechart span=1w ....
0 Karma

Explorer

it worked fine to me when i removed the "span=1w", leaving just 'eval _time=relative_time ....'

0 Karma

Path Finder

Hmm this still starts it on a Thursday. If i change the number to, say, "@w4" or "@w5" it just skips to the following Thursday.

0 Karma

SplunkTrust
SplunkTrust
0 Karma