https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43679#M10273 <P>I want to compare the results from one Saturday to 3-4 prior Saturdays. The query I am using is created from the postings here and returns the # of events/second that were logged for a particular host.</P> <PRE><CODE>host="Prod_LogHistory"| eval count=1 | timechart per_second(count) as events_per_second </CODE></PRE> <P>I would like to see a line chart that could show 3-4 Saturday's on the same chart.</P> Mon, 14 Feb 2011 07:23:11 GMT approachct 2011-02-14T07:23:11Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43679#M10273 <P>I want to compare the results from one Saturday to 3-4 prior Saturdays. The query I am using is created from the postings here and returns the # of events/second that were logged for a particular host.</P> <PRE><CODE>host="Prod_LogHistory"| eval count=1 | timechart per_second(count) as events_per_second </CODE></PRE> <P>I would like to see a line chart that could show 3-4 Saturday's on the same chart.</P> Mon, 14 Feb 2011 07:23:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43679#M10273 approachct 2011-02-14T07:23:11Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43680#M10274 <P>You could probably do it like this:</P> <PRE><CODE>host="Prod_LogHistory" earliest=-1mon@w6 | timechart span=1w per_second(count) as events_per_second </CODE></PRE> <P>That should snap the date back 1 month, round it to Saturday, then show a <STRONG>timechart</STRONG> with 1 week intervals from Saturday.</P> Mon, 14 Feb 2011 10:23:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43680#M10274 Ron_Naken 2011-02-14T10:23:30Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43681#M10275 <P>Is "| eval count=1" leftover text from a test?</P> Mon, 14 Feb 2011 10:51:07 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43681#M10275 Ron_Naken 2011-02-14T10:51:07Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43682#M10276 <P>host="Prod_LogHistory" date_wday=saturday earliest=-4w@w6 | eval count=1 | timechart span=24h per_second(count) as events_per_second</P> Tue, 15 Feb 2011 09:46:50 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43682#M10276 gkanapathy 2011-02-15T09:46:50Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43683#M10277 <P>This works to just give me the two days, but there is a large gap in the graph. Is there a way to see the prior weekday on the same graph at a same week day.</P> Fri, 08 Apr 2011 22:38:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43683#M10277 approachct 2011-04-08T22:38:03Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43684#M10278 <P><STRONG>Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.</STRONG></P> <P>I wrote a convenient search command called "<A href="http://apps.splunk.com/app/1645/">timewrap</A>" that does it all, for arbitrary time periods.</P> <PRE><CODE>... | timechart count span=1h | timewrap w </CODE></PRE> <P><STRONG>That's it!</STRONG></P> <P>If you want to limit it to a specific day of the week, add: </P> <PRE><CODE>... | where strftime(_time, "%A") == "Saturday" </CODE></PRE> <P><A href="http://apps.splunk.com/app/1645/"><STRONG></STRONG></A><A href="http://apps.splunk.com/app/1645/" target="test_blank">http://apps.splunk.com/app/1645/</A></P> Fri, 06 Dec 2013 21:42:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-a-Saturday-to-another-Saturday/m-p/43684#M10278 carasso 2013-12-06T21:42:00Z