Splunk Search

Timechart Per Day With Tick Mark Per Calendar Week

mzorzi
Splunk Employee
Splunk Employee

Ee would like to see a timechart of a chart with a time-based x-axis with a resolution per day, one bar per day but the tick marks and description on that axis shouldn't be the day but the calendar week.

Tags (1)
0 Karma

mzorzi
Splunk Employee
Splunk Employee

This seems to do the trick !

index=_internal source=*splunkd.log earliest=-20d | eval bytes=length(_raw) | eval WTime=strftime(_time,"%W") | eval userLabel=WTime | eval dateday=date_mday."_".date_month."_".date_year | stats max(bytes) as max by userLabel, dateday | eval userLabel="WeekYear=".userLabel | streamstats count by userLabel | eval userLabel=case(count==1,userLabel,count>=2," ") | table userLabel,max 
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...