Timechart Per Day With Tick Mark Per Calendar Week

[mzorzi]

Ee would like to see a timechart of a chart with a time-based x-axis with a resolution per day, one bar per day but the tick marks and description on that axis shouldn't be the day but the calendar week.

[mzorzi]

This seems to do the trick !

index=_internal source=*splunkd.log earliest=-20d | eval bytes=length(_raw) | eval WTime=strftime(_time,"%W") | eval userLabel=WTime | eval dateday=date_mday."_".date_month."_".date_year | stats max(bytes) as max by userLabel, dateday | eval userLabel="WeekYear=".userLabel | streamstats count by userLabel | eval userLabel=case(count==1,userLabel,count>=2," ") | table userLabel,max