I’ve been trying to create a yearly/half-yearly/quarterly/monthly/weekly report by using timechart and span command.
Actually most of all Japanese companies' 1st quarter starts from April, so I would like to define original quarter term like as Apr-Jun, Jul-Sep, Oct-Dec,Jan-Mar. Based on this rule, year term also become from Apr to Mar, and half-year term must be from Apr to Sep and from Oct to Mar.
As long as using Splunk function, year starting month seems to be fixed as Jan and cannot be changed.
(Our basic Time Period)
Year Apr-Mar
Half-year Apr-Sep
Quarter Apr-Jun etc
(Search command) following commands are not applicable to above requirement.
… | timechart span=1y count as …
… | timechart span=6mon count as …
… | timechart span=1q count as …
I’ve tried to use following command, but it was not counted from Apr.
earliest=@y4 latest=@y3 | timechart
Do you know the way to change the year starting date from A-Jan to 1-Apr, or if there is a better alternative, please let me know.
... View more