Hello,
How to use specific start date in weekly timechart?
For example: I have a set of Grade (Math, English, Science) data for Student1 and Student2 from 2/8/2024 to 3/1/2024
When I use timechart weekly, it always starts with 02/08/2024.
| timechart span=1w first(MathGrade) by Student useother=f limit=0
How do I start from other date, such as 02/09/2024 or 02/10/2024?
Thank you for your help
Here's the search
| makeresults format=csv data="_time,Student,MathGrade,EnglishGrade,ScienceGrade
1707368400,Student1,10,10,10
1707454800,Student1,9,9,9
1707541200,Student1,8,8,8
1707627600,Student1,7,7,7
1707714000,Student1,6,6,6
1707800400,Student1,5,5,5
1707886800,Student1,6,6,6
1707973200,Student1,7,7,7
1708059600,Student1,8,8,8
1708146000,Student1,9,9,9
1708232400,Student1,10,10,10
1708318800,Student1,10,10,10
1708405200,Student1,9,9,9
1708491600,Student1,8,8,8
1708578000,Student1,7,7,7
1708664400,Student1,6,6,6
1708750800,Student1,5,5,5
1708837200,Student1,6,6,6
1708923600,Student1,7,7,7
1709010000,Student1,8,8,8
1709096400,Student1,9,9,9
1709182800,Student1,10,10,10
1709269200,Student1,10,10,10
1707368400,Student2,9,9,9
1707454800,Student2,5,5,5
1707541200,Student2,6,6,6
1707627600,Student2,7,7,7
1707714000,Student2,8,8,8
1707800400,Student2,9,9,9
1707886800,Student2,5,5,5
1707973200,Student2,6,6,6
1708059600,Student2,7,7,7
1708146000,Student2,8,8,8
1708232400,Student2,9,9,9
1708318800,Student2,9,9,9
1708405200,Student2,5,5,5
1708491600,Student2,6,6,6
1708578000,Student2,7,7,7
1708664400,Student2,8,8,8
1708750800,Student2,9,9,9
1708837200,Student2,5,5,5
1708923600,Student2,6,6,6
1709010000,Student2,7,7,7
1709096400,Student2,8,8,8
1709182800,Student2,9,9,9
1709269200,Student2,9,9,9"
| table _time, Student, MathGrade, EnglishGrade, ScienceGrade
| timechart span=1w first(MathGrade) by Student useother=f limit=0
Hello @yuanliu ,
Thank you for assistance.
Comparing | bin _time span=1w (Left) and | bin _time span=1w@w (Right)
When the span was changed from 1w to 1w@w, it looks like the data was shifted from 2024-02-08 to 2024-02-04. Why did Splunk shift the data? Is this a normal behavior?
I expect the data for 2024-02-04 to be NULL.
Is there a way to leave the data as is (not shifting), when moving the start date to 2024-02-04?
Please suggest. I appreciate your help.
Hello,
Thank you for your help.
1) I ran your first suggestion on my search, I got different numbers than yours. Any idea why?
| timechart span=1w@w first(MathGrade) by Student useother=f limit=0
| _time | Student1 | Student2 |
| 2/4/2024 | 10 | 9 |
| 2/11/2024 | 7 | 7 |
| 2/18/2024 | 10 | 9 |
| 2/25/2024 | 6 | 5 |
2) I ran your second suggestion on my search, I also got different numbers than yours. Any idea why?
| eval _time = relative_time(_time, "-5d@d")
| timechart span=1w@w first(MathGrade) by Student useother=f limit=0
| eval _time = relative_time(_time, "+5d@d")
| _time | Student1 | Student2 |
| 2/2/2024 | 10 | 9 |
| 2/9/2024 | 9 | 5 |
| 2/16/2024 | 8 | 7 |
| 2/23/2024 | 6 | 8 |
| 3/1/2024 | 10 | 9 |
3) If I removed timechart command and only have the data and table, the data is only from 2024-02-08 to 2024-03-1, so there should be no data for 2024-02-04 and 2024-02-02.
Where did Splunk give data for 2024-02-04 and 2024-02-02 that should be NULL?
---Student Data---
| table _time, Student, MathGrade
First suggestion - snap to beginning of the week
| _time | Student1 - Math Grade | Student1 - expected Math Grade | Student2 - Math Grade | Student2 - expected Math Grade |
| 2024-02-04 | 10 | NULL | 9 | NULL |
| 2024-02-11 | 6 | 7 | 8 | 7 |
| 2024-02-18 | 10 | 10 | 9 | 9 |
| 2024-02-25 | 7 | 6 | 6 | 5 |
Second suggestion - begin on 02/09/2024
| _time | Student1 - Math Grade | Student1 - expected Math Grade | Student2 - Math Grade | Student2 - expected Math Grade |
| 2024-02-02 | 10 | NULL | 9 | NULL |
| 2024-02-09 | 8 | 9 | 6 | 5 |
| 2024-02-16 | 9 | 8 | 8 | 7 |
| 2024-02-23 | 5 | 6 | 9 | 8 |
Student 1 - Math Grade
Student 2 - Math Grade
