topic max values from two weeks using timechart in Splunk Search

max values from two weeks using timechart

secure — Tue, 18 Mar 2025 10:57:25 GMT

Hello Everyone,

i have a dataset where I'm generating a column of number of servers per day. using a timechart command for last 2 weeks.
earliest="-14d" latest=now() index=*...... | timechart span=1d dc(hostname) as servercount

My requirement is to split the data in previous week and latest week and get the maximum count from the previous week and the latest week

Re: max values from two weeks using timechart

gcusello — Tue, 18 Mar 2025 11:06:15 GMT

Hi @secure ,

did yu tried to use a different span period?

earliest="-14d" latest=now() index=*...... | timechart span=1w dc(hostname) AS servercount

Ciao.

Giuseppe

Re: max values from two weeks using timechart

PickleRick — Tue, 18 Mar 2025 11:25:23 GMT

@gcuselloThat's something different. You're calculating weekly count of distict values whereas, as I understand, @secure wants to have maximum value of daily distinct count per week.

There are several possible approaches here.

One is to use the timechart output and use timewrap to transform the output into separate weekly data series. Since timewrap is a relatively straightforward command I'll leave the actual search to the reader 😉

Another way is to do manual binning

<@secure's search>
| bin _time span=1w as weekno
| stats max(servercount) by weekno