https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50523#M12136 <P>In that case you can use the join command with sub searches:</P> <P><CODE><BR /> sourcetype="Your Sourcetype" earliest=@w1-2w+9h latest=@w1-2w+10h | chart count as "Two Weeks Ago" by Operation | join Type=outer [search sourcetype="Your Sourcetype" earliest=@w1-1w+9h latest=@w1-1w+10h | chart count as "One Week Ago" by Operation] | join Type=outer [search sourcetype="Your Sourcetype" earliest=@w1+9h latest=@w1+10h | chart count as "This Week" by Operation] | whatever stats you'd like to do to your results<BR /> </CODE></P> <P>@w1 is Monday,<BR /> 1w is 1 week,<BR /> 2w is 2 weeks,<BR /> etc...</P> <P>If you want to run this every hour as an alert, just get rid of the +9h and +10h time modifiers and set the search to run on an hourly basis and send a mail.</P> Thu, 30 May 2013 09:39:37 GMT watsm10 2013-05-30T09:39:37Z https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50521#M12134 <P>How do I get an average count of operations during current minute using last 3 weeks, for example?<BR /> I need to know how to get the distribution of number of operations during the time of day (every minute, or five minutes, for example)</P> Thu, 30 May 2013 08:47:08 GMT https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50521#M12134 0range 2013-05-30T08:47:08Z https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50522#M12135 <P>I need to put the events happened at 9-00 this monday together with the events happenned at 9-00 on monday a week ago, and also two weeks ago. And I want to do this for each time interval.</P> Thu, 30 May 2013 09:22:21 GMT https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50522#M12135 0range 2013-05-30T09:22:21Z https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50523#M12136 <P>In that case you can use the join command with sub searches:</P> <P><CODE><BR /> sourcetype="Your Sourcetype" earliest=@w1-2w+9h latest=@w1-2w+10h | chart count as "Two Weeks Ago" by Operation | join Type=outer [search sourcetype="Your Sourcetype" earliest=@w1-1w+9h latest=@w1-1w+10h | chart count as "One Week Ago" by Operation] | join Type=outer [search sourcetype="Your Sourcetype" earliest=@w1+9h latest=@w1+10h | chart count as "This Week" by Operation] | whatever stats you'd like to do to your results<BR /> </CODE></P> <P>@w1 is Monday,<BR /> 1w is 1 week,<BR /> 2w is 2 weeks,<BR /> etc...</P> <P>If you want to run this every hour as an alert, just get rid of the +9h and +10h time modifiers and set the search to run on an hourly basis and send a mail.</P> Thu, 30 May 2013 09:39:37 GMT https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50523#M12136 watsm10 2013-05-30T09:39:37Z https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50524#M12137 <P>thank you</P> <P>I think I really need something like this:</P> <P>sourcetype=MySource operation=MyOp <BR /> earliest = -15m@m latest = -0m@m | <BR /> rex " (?P<HHMM>\d\d:\d\d)" | <BR /> chart count as "0wAgo" by hhmm | <BR /> join type=inner hhmm <BR /> [search <BR /> sourcetype=MySource operation=MyOp<BR /> earliest = -1w@m-15m@m latest = -1w@m |<BR /> rex " (?P<HHMM>\d\d:\d\d)" |<BR /> chart count as "1wAgo" by hhmm |<BR /> join type=inner hhmm <BR /> [search <BR /> sourcetype=MySource operation=MyOp <BR /> earliest = -2w@m-15m@m latest = -2w@m | <BR /> rex " (?P<HHMM>\d\d:\d\d)" |<BR /> chart count as "2wAgo" by hhmm<BR /> ]<BR /> ]</HHMM></HHMM></HHMM></P> Thu, 30 May 2013 11:34:38 GMT https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50524#M12137 0range 2013-05-30T11:34:38Z https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50525#M12138 <P>you could use the in-built _time field instead of extracting the time field using regex. So...</P> <P>....| chart count as "1wAgo" by _time |<BR /> join type=inner _time<BR /> [search.....</P> <P>OR </P> <P>you could use the timechart command instead of chart.</P> Thu, 30 May 2013 13:51:04 GMT https://community.splunk.com/t5/Splunk-Search/statistic-by-week-days/m-p/50525#M12138 watsm10 2013-05-30T13:51:04Z