topic How do you use timewarp in specific? in Splunk Search

How do you use timewarp in specific?

phamxuantung — Fri, 29 Oct 2021 02:43:33 GMT

Let's say I have this query

index = x |stats count as Total, sum(AMMOUNT) as TAmmount BY MERCHANT, SUBMERCHANT

I want to make a comparison by percentage between this month to the average of TOTAL three month ago. How do you go about using timewarp to archive that goal?

Re: How do you use timewarp in specific?

PickleRick — Fri, 29 Oct 2021 04:46:25 GMT

For timewrap you need results of timechart.

Re: How do you use timewarp in specific?

tread_splunk — Fri, 29 Oct 2021 12:33:47 GMT

You can adapt this. I don't have months of data on my laptop. So I've produced a chart with 2 lines. One line is the last minute of activity (count of events per second), the other line is the average activity based on the 4 minutes before that.

index=_internal sourcetype=splunkd component=Metrics earliest=-5min@min latest=@min | timechart span=1s count | eval latestMinute=if(_time>=relative_time(now(),"-1m@m"),"LatestMinute","Average"), sec=strftime(_time,"%S") | chart avg(count) over sec by latestMinute