topic Re: Today date and previous day data in Splunk Search

Today date and previous day data

uagraw01 — Mon, 19 Oct 2020 14:46:23 GMT

I want to calculate todays date data and previous day data from the host. Please suggest SPL for this.

Re: Today date and previous day data

gcusello — Mon, 19 Oct 2020 15:09:36 GMT

see if this example solves your need:

index=_internal | eval day=if(date_year=strftime(now(),"%Y") AND date_month=lower(strftime(now(),"%B")) AND date_mday=strftime(now(),"%d"),"Today","Previous") | stats count BY day

Ciao.

Giuseppe

Re: Today date and previous day data

inventsekar — Mon, 19 Oct 2020 15:41:27 GMT

hi @uagraw01 just curious - earliest and latest variables are ok or not ok?

Re: Today date and previous day data

uagraw01 — Tue, 20 Oct 2020 14:27:19 GMT

@gcusello I want the difference between pervious day count of the host and current day count of the host. I want comparison panel in my dashboard

Re: Today date and previous day data

gcusello — Tue, 20 Oct 2020 14:38:20 GMT

Hi @uagraw01,

as I said, I don't know in deep your need, but you can use my approach.

so using a search like mine you can display the count of events of today and previous day so you can compare the two numbers.

If you want more help, you should share more infos, e.g.:

what's you main search
which count you want to compare (e.g. numer of hosts).

so if you want to display the diference in numer of logging hosts between today and yesterday, you could run something like this:

index=_internal earliest=-d@d latest=now | eval day=if(date_year=strftime(now(),"%Y") AND date_month=lower(strftime(now(),"%B")) AND date_mday=strftime(now(),"%d"),"Today","Previous") | stats dc(host) AS hosts BY day | delta hosts AS diff | table diff

Ciao.

Giuseppe

Ciao.

Giuseppe

Re: Today date and previous day data

uagraw01 — Tue, 20 Oct 2020 14:56:54 GMT

Below is "no result" i am getting. I need todays day count, previous day count and the difference between todays count and previous day count. From the above query as you suggested not getting any results.

Re: Today date and previous day data

gcusello — Tue, 20 Oct 2020 14:59:55 GMT

Hi @uagraw01,

this is because you have only today's events!

enlarge your data frame and you'll have results.

Ciao.

Giuseppe

Re: Today date and previous day data

uagraw01 — Tue, 20 Oct 2020 16:02:39 GMT

@gcusello Can you suggest me another method. I mean another SPL. Because this search is very slow while executing.

Re: Today date and previous day data

gcusello — Tue, 20 Oct 2020 17:55:36 GMT

Hi @uagraw01,

if in yyour search you can use only the index time fields (index, sourcetyoe, source and host) you can use "|metasearch", having someting like this:

| metasearch index=_internal earliest=-d@d latest=now | eval date_year=strftime(_time,"%Y"), date_month=strftime(_time,"%B"),date_mday=strftime(_time,"%d") | eval now_date_year=strftime(now(),"%Y"), now_date_month=strftime(now(),"%B"),now_date_mday=strftime(now(),"%d") | eval day=if(date_year=now_date_year AND date_month=now_date_month AND date_mday=now_date_mday,"Today","Previous") | stats count BY day | delta count AS diff | reverse | table diff | head 1

Ciao.

Giuseppe

Re: Today date and previous day data

isoutamo — Tue, 20 Oct 2020 20:15:31 GMT

At least in some older versions of splunk only official way was use all time as search period with metasearch. With other periods result was or wasn’t exactly correct. I’m not sure if this UFs still valid or not. Unfortunately I couldn’t find where I have gotten this information and could evaluate it now.

Re: Today date and previous day data

gcusello — Wed, 21 Oct 2020 06:28:08 GMT

Hi @inventsekar,

I tried on my Splunk and correctly worked.

Ciao.

Giuseppe

Re: Today date and previous day data

uagraw01 — Wed, 21 Oct 2020 06:39:09 GMT

@gcusello It is working fine now . Thanks for yours extended help.

Re: Today date and previous day data

gcusello — Wed, 21 Oct 2020 07:37:37 GMT

Hi @uagraw01,

good for you, please accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe