topic Compare week and last week by host in Splunk Search

Compare week and last week by host

nravichandran — Mon, 28 Sep 2020 19:49:01 GMT

I am trying to improve on the query below to show timechart by host for last week and this week. When I do "by host" it is not showing last week comparision. here is the query:
sourcetype=permon host="abc*" earliest=-2w@w latest=@w|eval marker = if(_time < relative_time(now(),"-1w@w"),"last week","this week")|eval _time = if(marker == "last week", _time + 7*24*60*60,_time) | timechart span=15m avg(PercentProcessorTime) as AvgPercentProcessorTime by marker (here how to do by host and by marker)

Re: Compare week and last week by host

woodcock — Sat, 02 May 2015 21:28:21 GMT

Timewrap:
https://splunkbase.splunk.com/app/1645/

Re: Compare week and last week by host

nravichandran — Sat, 02 May 2015 22:36:34 GMT

Unfortunately I cannot use this app as I am a normal user of splunk in my organization.

Re: Compare week and last week by host

woodcock — Sat, 02 May 2015 23:20:07 GMT

Even if you cannot use the app, you can download it and look at the code, searches, macros, etc. and learn how it works. It is actually somewhat complicated to do what you are trying to do and look at how Timewrap works will be a huge help in you getting it done, even without being able to install it. Also, depending on what privileges you do have, you might very well be able to recreate the app by copying and adding all of the Knowledge Objects by hand.

Re: Compare week and last week by host

nravichandran — Mon, 04 May 2015 15:39:58 GMT

Unfortunately I cannot use timewrap as I cannot import the app. Is there any other way to get the desired result?