topic Re: How to search a weekly average and daily total? in Splunk Search

How to search a weekly average and daily total?

chengyu — Mon, 28 Sep 2020 19:54:05 GMT

Hi Sir:

The first query I calculate the daily amount, calculated after the date +7 days, the average amount of 5/9 to 5/16, the field name is Totalweekqty, Totalweekqty still calculate the number of the day. How do i make |search now < week| or | where now < month | working? Thank you.

sourcetype=xxx PartNo=123 VendorCode=1000 storage_in_date=2014-05-09*
| eval Indate = substr(storage_in_date, 1, len(storage_in_date)-13)
| eval now = strptime(Indate, "%Y-%m-%d")
|eval week=(now+604800)
|eval month=(now+2592000)
| stats sum(qty) as Totaldayqty values(now) as now values(week) as week values(month) as month by VendorCode,PartNo

|search now < week
| stats values(Totaldayqty) as Totaldayqty avg(Totaldayqty) as Totalweekqty values(now) as now values(week) as week values(month) as month by VendorCode,PartNo

| where now < month | stats values(Totaldayqty) as Totaldayqty values(Totalweekqty) as Totalweekqty avg(Totalweekqty) as Totalmonthkqty by VendorCode,PartNo |

Re: How to search a weekly average and daily total?

vganjare — Thu, 14 May 2015 05:34:07 GMT

Hi,

As you are constructing week and month from now, following case will be always true

now < week < month

Also, for all the events, you will get same values for now, week, and month.

Can you please explain what is required? If possible, share some sample events and what is the expected output.

Thanks!!

Re: How to search a weekly average and daily total?

woodcock — Tue, 19 May 2015 15:13:04 GMT

You need to scrap everything after the first pipe ("|"), show us a few events from your base search, and then clearly explain what you are trying to accomplish. Your search makes no sense and there is not enough explanation to allow us to understand what you are trying to do.

Re: How to search a weekly average and daily total?

thomrs — Tue, 19 May 2015 19:43:48 GMT

Getting started with stats, eventstats and streamstats may be what you are looking for.

http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/

If that does not help more info will be needed.

Re: How to search a weekly average and daily total?

chengyu — Wed, 20 May 2015 05:13:45 GMT

Hi Guys, finally use "delta" command, thank you everybody kindly support.