Splunk Search

Timechart Per Day With Tick Mark Per Calendar Week

mzorzi
Splunk Employee
Splunk Employee

Ee would like to see a timechart of a chart with a time-based x-axis with a resolution per day, one bar per day but the tick marks and description on that axis shouldn't be the day but the calendar week.

Tags (1)
0 Karma

mzorzi
Splunk Employee
Splunk Employee

This seems to do the trick !

index=_internal source=*splunkd.log earliest=-20d | eval bytes=length(_raw) | eval WTime=strftime(_time,"%W") | eval userLabel=WTime | eval dateday=date_mday."_".date_month."_".date_year | stats max(bytes) as max by userLabel, dateday | eval userLabel="WeekYear=".userLabel | streamstats count by userLabel | eval userLabel=case(count==1,userLabel,count>=2," ") | table userLabel,max 
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...