Splunk Search

How to display a year's data on a quarterly basis, and define which months are considered for each quarter?

smaran06
Path Finder

Hi Team,

I have data for the year 2016. I want to display the data on a quarterly basis, and I want to customize the duration for each quarter, like 2016 DEC- 2017 Feb as one quarter and 2017 March to 2017 June as one quarter etc.

Can you please let me know, how this can be achieved?

I googled and got this query, but not sure how this will work.

 |eval period=strftime(_time,"%Y")."-Q".(round(tonumber(strftime(_time,"%m"))/3)+ 1)
Tags (3)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

There are lots of ways, but I'm not sure what you meant in your "customize the duration of each quarter", since your second example is four months long.

If you want to do that, having quarters that are not, in the mathematical or accounting sense, three months long, then your best bet is to create a lookup table and look up the fiscal quarter that way.

YYYY_MM   FISCALQ
2016-12   2017-Q1
2017-01   2017-Q1
2017-02   2017-Q1
2017-03   2017-Q2
2017-04   2017-Q2
2017-05   2017-Q2
2017-06   2017-Q2
2017-07   2017-Q3

You could also go one step further and have the beginning and ending day-dates in your lookup table, in case, for example, you were trying to map a lunar calendar (Islamic or Jewish or whatever) onto a western quarterly fiscal reporting structure.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...