Splunk Search

How to display a year's data on a quarterly basis, and define which months are considered for each quarter?

smaran06
Path Finder

Hi Team,

I have data for the year 2016. I want to display the data on a quarterly basis, and I want to customize the duration for each quarter, like 2016 DEC- 2017 Feb as one quarter and 2017 March to 2017 June as one quarter etc.

Can you please let me know, how this can be achieved?

I googled and got this query, but not sure how this will work.

 |eval period=strftime(_time,"%Y")."-Q".(round(tonumber(strftime(_time,"%m"))/3)+ 1)
Tags (3)
0 Karma

DalJeanis
Legend

There are lots of ways, but I'm not sure what you meant in your "customize the duration of each quarter", since your second example is four months long.

If you want to do that, having quarters that are not, in the mathematical or accounting sense, three months long, then your best bet is to create a lookup table and look up the fiscal quarter that way.

YYYY_MM   FISCALQ
2016-12   2017-Q1
2017-01   2017-Q1
2017-02   2017-Q1
2017-03   2017-Q2
2017-04   2017-Q2
2017-05   2017-Q2
2017-06   2017-Q2
2017-07   2017-Q3

You could also go one step further and have the beginning and ending day-dates in your lookup table, in case, for example, you were trying to map a lunar calendar (Islamic or Jewish or whatever) onto a western quarterly fiscal reporting structure.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...