1

I want to display a bar diagram where each bar represents a week starting on a Monday.
The below meta code does that except that each week starts on a Sunday.

I realize that the Query syntax only mentions time periods with m for minutes and h for hours, but it seems to work fine also using d for day and w for week (except that I cannot set the starting day).

Any idea how to make weeks starting on Mondays instead of Sundays?

fields @timestamp, @message
| fields strcontains(@message, 'the start') as start
| fields strcontains(@message, 'the result') as result
| stats sum(start) as startCalls, sum(result) as resultCalls by bin(1w) as t
| sort t asc
Sven Emtell
  • 11
  • 3

1 Answers1

0

I think the following will work: "fromMillis(toMillis(bin(1w))+86400000) as Week"

Anil Gunturu
  • 1
  • 1