Get Data Per Week within a Month

G.Anshar — Mon, 07 Jul 2025 07:43:05 GMT

Hello, I would like to ask how to retrieve dat per-week within a month. My current query is like:

config timeframe = 30d
| dataset = incidents
| bin creation_time span = 7d

.....

but i don't think its working properly, could you please help me to fix or improve it 🙂

Thank You....

Re: Get Data Per Week within a Month

Mudhireddy — Mon, 07 Jul 2025 08:00:56 GMT

config timeframe = 30d
| dataset = incidents
| alter week_start = date_floor(creation_time, "w")
| comp count() as incidents_per_week by week_start
| sort asc week_start

And here the details:

config timeframe = 30d: This sets the overall search window to the last 30 days.
dataset = incidents: Specifies that you're querying the incidents dataset.
| bin creation_time span = 7d as week_interval: This is the core for "per-week". It groups all incidents by their creation_time into distinct 7-day bins. The as week_interval assigns a readable name to the timestamp representing the start of each 7-day period.
| aggregate count() as incident_count: After binning, this counts how many incidents fall into each week_interval bucket.
| sort by week_interval asc: (Optional) This just orders your results from the oldest 7-day period to the newest.

topic Re: Get Data Per Week within a Month in Cortex XDR Discussions

Get Data Per Week within a Month

Re: Get Data Per Week within a Month