topic Re: search for eventcount comparison for two different time ranges in Splunk Search

search for eventcount comparison for two different time ranges

john_q — Tue, 17 Jul 2018 06:39:14 GMT

i want to count eventcount comparison using time trends chart for today , lastweek and last2weeks. below are the my searches

index=something sourcetype=something earliest=-0d@d latest=@h| timechart count as "Today" | appendcols
[search index=something sourcetype=something earliest=-7d@w0 latest=@w0
| timechart count as "Previous week"]

for this iam getting output like this:alt text

Re: search for eventcount comparison for two different time ranges

MuS — Tue, 17 Jul 2018 08:45:12 GMT

Hi john_q,

take a look at this answer https://answers.splunk.com/answers/663294/timewrap-compare-last-24-hours-to-the-same-day-ove.html to learn how this can be done without any sub search.

cheers, MuS

Re: search for eventcount comparison for two different time ranges

niketn — Tue, 17 Jul 2018 08:47:07 GMT

@john_q could you please add a mock screenshot of what is the expected output?

Ideally when you compare time-series data over a duration, the duration needs to remain the same for different time period selected (as duration is plotted on fixed x-axis). For example You can compare current week with Previous week and that with the week before. For such scenario, you can use the timewrap command which is available version 6.5 onward.

Re: search for eventcount comparison for two different time ranges

john_q — Wed, 18 Jul 2018 05:54:43 GMT

i getting results like mentioned below.

      _time                              Today              LastWeek

06-07-2018 06:01:01 120 1000
06-07-2018 07:11:01 10 1012
06-07-2018 08:01:01 20 1128
06-07-2018 09:05:01 105 1222
06-07-2018 09:41:01 80

06-07-2018 10:15:01 16

06-07-2018 10:22:01 12

06-07-2018 10:51:01 1

two line are showing today time only and LastWeek legend showing today time only instead of lastweek time which is not fully completed. plz find the above attached image.