how to get weekly data and week should be between saturday to friday

[Chinmai]

Hello Guys,

I have a requirement to show count of open tickets for every week.
Week should be between saturday to friday. So x-axis should contain points of every friday. So for every friday we should show the count of tickets raised from last saturday to this friday.

Can anyone help me to achieve this?

Many Thanks in advance.

[adonio]

use this answer:
https://answers.splunk.com/answers/30430/previous-business-week-day.html
and this doc:
https://docs.splunk.com/Documentation/Splunk/6.6.0/Search/Specifytimemodifiersinyoursearch

describes it thoroughly

hope it helps

[ckunath]

index=your_index earliest=-6d@d latest=now | timechart span=1d count(open_tickets) by date_wday

This search should always show the count of open_tickets for each weekday in the last 7 days.

Do you want to create a dashboard panel of it? Otherwise you could save this as report and let it run on every Friday night.

[Chinmai]

this wont give me the weekly data as i wanted and i wanted it in a dashboard panel.

see for example, today is friday, so for today(may 5) it should show the count of open tickets raised from last saturday(april 29) till today.

Similarly, for april 28(last friday), the count should show the number of open tickets raised from april 22nd to april 28.

[ckunath]

What does an event with an open ticket look like? Is it just the event being there or is there a certain field value to look out for?

[Chinmai]

certain field value like State="Active", i can get the open tickets but i am finding difficulty to find tickets raised from every last saturday to this friday.

[ckunath]

index=your_index State="Active" earliest=@w6@d latest=@w6@d+7d | stats count

Shows the count of all open tickets from previous Saturday until the end of Friday.
If you want to exclude friday, use latest=@w5@d+7d

[ckunath]

I'm not completely understanding your question - do you what to have a timechart that always goes from last saturday to next friday with a bar that shows how many open tickets there are on that day, and how many there were on that weekday of the last week?

[Chinmai]

see for example, today is friday, so for today(may 5) it should show the count of open tickets raised from last saturday(april 29) till today.

Similarly, for april 28, the count should show the number of open tickets raised from april 22nd to april 28.