Reporting

Split a Report in Weeks

Oti47
Path Finder

Hello,
I'd like to split a Report in Weeks.
I use a time chart report with span=1week, but the y-axis display the first day of a week.

XXX | timechart span=1week sum(NWert) AS Umsatz

How could i change the display of the x-axis in Weeks like this 22, 23, 24, 25?

Thanks
Oti

Tags (1)
1 Solution

echalex
Builder

Hi Oti47,

Rather than using timechart, use chart by week. You'll get the weeknumber from strftime:

XXX | eval week=strftime(_time,"%V") |chart sum(NWert) AS umsatz by week

HTH,

View solution in original post

echalex
Builder

Glad it worked. Feel free to accept the answer as the correct one, so others can see it's solved.

0 Karma

Oti47
Path Finder

Thanks.

Works for me.

0 Karma

echalex
Builder

Hi Oti47,

Rather than using timechart, use chart by week. You'll get the weeknumber from strftime:

XXX | eval week=strftime(_time,"%V") |chart sum(NWert) AS umsatz by week

HTH,

echalex
Builder

Note!

This works for the ISO 8601 standard, where a week starts on Monday and the first week of the year is the first to have at least four days of the new year in it. Iow. if 1st Jan is on a Friday, its week number is 53 of the last week.

Users who would like to have the week starting on a Sunday, should consider using %U rather than %V.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...