https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237317#M188633 <P>I have my query like below, but the problem is it shows the same date on both last weeks and this weeks chart when i mouse on the bar chart.</P> <PRE><CODE>index = isell sourcetype=iSell_sessionslog Region = EU BusinessServiceName= BsSaveSalesOrderList Success = False earliest=-2w@w latest=@w |bucket span=1d _time | eval marker=if (_time </CODE></PRE> Tue, 11 Oct 2016 17:38:56 GMT sushe10 2016-10-11T17:38:56Z https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237313#M188629 <P>Is there a better way to report the count of hosts reporting to Splunk week over week other than running the query using <CODE>index=*</CODE></P> <P>I am not looking for the no of forwarders, I am looking distinct count of <CODE>host</CODE> value in all the indexes, |metadata type=hosts do not help as it cannot be used for week over week calculation</P> <PRE><CODE>index=* earliest=-2w@w latest=@w | bucket span=1d _time | stats count by _time host | eval marker=if (_time&lt;relative_time(now(),"-w@w"), "last week","this week") | eval _time=if(marker=="last week", _time + 7*24*60*60, _time) | timechart count by marker </CODE></PRE> Mon, 07 Mar 2016 21:52:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237313#M188629 mohankesireddy 2016-03-07T21:52:13Z https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237314#M188630 <P>A faster option is to use the tstats which works on tsidx files, metadata fields including _time. Try something like this</P> <PRE><CODE>| tstats count WHERE index=* AND (host=slc* OR host=phx* OR host=dcg* OR host=ccg*) earliest=-2w@w latest=@w by _time host | eval marker=if (_time&lt;relative_time(now(),"-w@w"), "last week","this week") | eval _time=if(marker=="last week", _time + 7*24*60*60, _time) | timechart count by marker </CODE></PRE> Mon, 07 Mar 2016 21:58:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237314#M188630 somesoni2 2016-03-07T21:58:44Z https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237315#M188631 <P>Thanks Somesh</P> Mon, 07 Mar 2016 22:37:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237315#M188631 mohankesireddy 2016-03-07T22:37:38Z https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237316#M188632 <P>Also, for your presentation once you pull the data out, tihink about using <CODE>timewrap</CODE> app:<BR /> <A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> Mon, 07 Mar 2016 22:47:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237316#M188632 woodcock 2016-03-07T22:47:35Z https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237317#M188633 <P>I have my query like below, but the problem is it shows the same date on both last weeks and this weeks chart when i mouse on the bar chart.</P> <PRE><CODE>index = isell sourcetype=iSell_sessionslog Region = EU BusinessServiceName= BsSaveSalesOrderList Success = False earliest=-2w@w latest=@w |bucket span=1d _time | eval marker=if (_time </CODE></PRE> Tue, 11 Oct 2016 17:38:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-query-for-a-Week-over-Week-count-of-hosts-reporting-to/m-p/237317#M188633 sushe10 2016-10-11T17:38:56Z