topic Re: How to compare two weeks ? in Splunk Search

How to compare two weeks ?

falcom92 — Fri, 20 Feb 2015 10:59:12 GMT

Hi,

I use Splunk 6.2.

I try to compare two values between two differents weeks.

index="market_logs" host="12.0.0.1" OR host="12.0.0.2" 
AND status="rejected" OR status="error" 
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| eval r_before =
    [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2" 
    AND status="rejected" OR status="error" 
    AND srcip="192.168.0.1" OR srcip="192.168.0.2" 
    earliest=-14d@h latest=-7d@h
    | stats count] 
| stats count AS r_now

But it doesn't work. I have the following error : "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])."

I use a script who extract the two values.

Can someone help me please ?

Thanks,

falcom92

Re: How to compare two weeks ?

MuS — Fri, 20 Feb 2015 12:27:51 GMT

Hi falcom92,

use the timewrap app https://apps.splunk.com/app/1645 which will handle such things or take a look at this answer http://answers.splunk.com/answers/185829/how-to-create-a-custom-macro-function-inside-the-s.html to get an idea how it can be done using some stats commands.

Hope this helps ...

cheers, MuS

Re: How to compare two weeks ?

falcom92 — Wed, 25 Feb 2015 09:28:09 GMT

I find the solution with append and it works.

index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| stats count
| append [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
earliest=-14d@h latest=-7d@h
| stats count]

Thanks.

Re: How to compare two weeks ?

markthompson — Wed, 25 Feb 2015 09:49:19 GMT

Hi Falcom,
For ease of use I'd recommend the timewrap app, it adds an extra command/function to the search which lets you set a span, either by day, by week, by month for 1 search, which could help improve search speeds.

Re: How to compare two weeks ?

MuS — Wed, 25 Feb 2015 09:54:49 GMT

I second this or use stats which will out-perform anything else - especially on long runs over a bigger time range.
Any kind of sub search such be your last resort not your first choice ....