How to get data for last week and current week?

[agupta13]

I have data stored in the csv file, which contains the time field. I want the data for complete last week and also the data for current week.

Eg

Day1: 100
day2: 200.

.

.

.

.Day14:600

I want data from day1-day7 -> Current week and day7-14 -> Previous week

I am doing something like below, but it gives me data from current week 

| eval first_day_last_week=relative_time(relative_time(now(),"-1w@w"),"-1d@d"), last_day_last_week=relative_time(relative_time(now(),"-1w@w"),"+6d@d") 
| where _time>=first_day_last_week AND _time<=last_day_last_week 

technically the data should not come up as today is the Aug 7 and it should not show as it is from current week

[bowesmana]

As of August 8th (Australia) - the first day LAST week is 29th July and the last day last week is the 5th August - Sun-Sat. This would also be true in your case of Mon 7th August. The "Current week" is 7th-13th August.

Therefore the dates of the events you have are 3rd and 4th of August which is the Thu/Fri LAST week, so that data is giving what you are asking for.

[PickleRick]

I think you're overcomplicating that a bit.

If you just want to count by days or weeks why not starting with either

| bin _time span=1d

(or 1w)

And if you want to do some aggregation you could just timechart instead.

Anyway, even if you want to just filter, your method of calculating relative time vs relative time is a bit strange.