Thank you for your prompt reply.
Unfortunately, we've not received the expected result, but we could find the appropriate command like as follows
convert TIMEFORMAT="%m" ctime(_time) AS month | eval
month<=12,date_year."年度後期",1=1,"missing") | chart count as "アクセス数" by
half period_search_name usenull=f useother=f
I appreciate your support.
... View more
I’ve been trying to create a yearly/half-yearly/quarterly/monthly/weekly report by using timechart and span command.
Actually most of all Japanese companies' 1st quarter starts from April, so I would like to define original quarter term like as Apr-Jun, Jul-Sep, Oct-Dec,Jan-Mar. Based on this rule, year term also become from Apr to Mar, and half-year term must be from Apr to Sep and from Oct to Mar.
As long as using Splunk function, year starting month seems to be fixed as Jan and cannot be changed.
(Our basic Time Period)
Quarter Apr-Jun etc
(Search command) following commands are not applicable to above requirement.
… | timechart span=1y count as …
… | timechart span=6mon count as …
… | timechart span=1q count as …
I’ve tried to use following command, but it was not counted from Apr.
earliest=@y4 latest=@y3 | timechart
Do you know the way to change the year starting date from A-Jan to 1-Apr, or if there is a better alternative, please let me know.
... View more