I want to display counts by weeks . but current week's count in "green", last weeks counts in "Orange" and counts older than two weeks in "Red".
| tstats count where index=_internal by _time span=1d prestats=t
| timechart span=1d count
| eval week=case(_time < relative_time(now(),"-2w"),"twoWeeksAgo", _time < relative_time(now(),"-1w"),"lastWeekAgo",true(),"Current")
| eval weekday=strftime(_time,"%A") | chart sum(count) as count by weekday week
To change the color, please refer to this page.
| tstats count where index=_internal by _time span=1d prestats=t
| timechart span=1d count
| eval week=case(_time < relative_time(now(),"-2w"),"twoWeeksAgo", _time < relative_time(now(),"-1w"),"lastWeekAgo",true(),"Current")
| eval weekday=strftime(_time,"%A") | chart sum(count) as count by weekday week
To change the color, please refer to this page.