topic Re: Compare current week to last week in a visualisation in Splunk Search

How to compare current week to last week in a visualisation?

supersnedz — Thu, 27 Apr 2023 13:50:53 GMT

Hello, im looking to compare a count of servers that was reporting into splunk this week and compare to the amount that reported the week before. Im using the Dashboard studio for my visualisations.

My current query shows how many servers reported per day over the week: an represents the server name.

index="siem-ips" cim_entity_zone="global" | timechart dc(an)

How can i modify this to show what the previous week looked like over the current week?

Thank you 🙂

Re: Compare current week to last week in a visualisation

rut — Thu, 27 Apr 2023 10:32:03 GMT

Hi @supersnedz, you can follow up timechart with the timewrap command:

| timewrap 1w

You can read more about timewrap over here:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap

Re: Compare current week to last week in a visualisation

supersnedz — Thu, 27 Apr 2023 12:39:14 GMT

Hi @rut

I tried the following:
index="siem-eu" cim_entity_zone="global" | timechart span=1d dc(an) | timewrap 1w

It returned only one day from the previous week rather than the whole week.

is there a way i can do this for each day of the week?

Re: Compare current week to last week in a visualisation

rut — Thu, 27 Apr 2023 12:57:41 GMT

Are you sure you're retrieving enough data (so the earliest is set correctly)?

You can play around with timewrap with the following example. Try setting count to 8 (which matches your screenshot) and 21 (which compares three weeks):

| makeresults count=14 ``` Set up the data, count the days and subtract them from _time ``` | streamstats count | eval _time=relative_time(_time, "-".(count -1)."d") ``` Chart the data by day ``` | timechart sum(count) span=1d ``` Compare it by week ``` | timewrap 1w

Re: Compare current week to last week in a visualisation

supersnedz — Thu, 27 Apr 2023 14:30:24 GMT

Ah yes, I was being silly and had the time frame set to 7 days rather than 14! Thank you for the help i really appreciate it!