https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205837#M59864 <P>Hi rck,</P> <P>Try to run this if you want to get the specific data for the particular date;</P> <PRE><CODE>sourcetype="rum" u=*|streamstats count,avg(t_done),max(t_done),min(t_done) by u|timechart span=w max(t_done) </CODE></PRE> <P>This will displays you data for each week.</P> Wed, 17 Feb 2016 09:27:04 GMT ngatchasandra 2016-02-17T09:27:04Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205834#M59861 <P>How can I compare the result by a particular week or date for this search?</P> <PRE><CODE>sourcetype="rum" u=* |stats count,avg(t_done),max(t_done),min(t_done) by u|sort - max(t_done) </CODE></PRE> Wed, 17 Feb 2016 06:27:46 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205834#M59861 rck 2016-02-17T06:27:46Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205835#M59862 <P>If you just want to list it based on dates , then use <CODE>timechart</CODE></P> <PRE><CODE>sourcetype="rum" u=* |timechart span=1d count,avg(t_done),max(t_done),min(t_done) by u </CODE></PRE> <P>OR</P> <PRE><CODE>sourcetype="rum" u=* |bucket span=1d _time|stats count,avg(t_done),max(t_done),min(t_done) by u,_time|sort - max(t_done) </CODE></PRE> Wed, 17 Feb 2016 08:25:06 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205835#M59862 renjith_nair 2016-02-17T08:25:06Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205836#M59863 <P>how can i get the specific data for the particular date</P> Wed, 17 Feb 2016 09:17:24 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205836#M59863 rck 2016-02-17T09:17:24Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205837#M59864 <P>Hi rck,</P> <P>Try to run this if you want to get the specific data for the particular date;</P> <PRE><CODE>sourcetype="rum" u=*|streamstats count,avg(t_done),max(t_done),min(t_done) by u|timechart span=w max(t_done) </CODE></PRE> <P>This will displays you data for each week.</P> Wed, 17 Feb 2016 09:27:04 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205837#M59864 ngatchasandra 2016-02-17T09:27:04Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205838#M59865 <P>You can set the timerange or adjust the earliest and latest fields to your required date</P> Wed, 17 Feb 2016 09:33:19 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205838#M59865 renjith_nair 2016-02-17T09:33:19Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205839#M59866 <P>i just want to retrieve the data for the date 11/02/1016,12/02/1016,13/02/1016.how can i specify this.</P> Wed, 17 Feb 2016 09:33:33 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205839#M59866 rck 2016-02-17T09:33:33Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205840#M59867 <P>Hi<BR /> try this search code just add for example earliest=-3d@d latest=-0d@d</P> <PRE><CODE>sourcetype="rum" u=* earliest=-3d@d latest=-0d@d|stats count,avg(t_done),max(t_done),min(t_done) by u|sort - max(t_done) </CODE></PRE> Wed, 17 Feb 2016 09:52:01 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-results-of-the-same-search-by-a-particular/m-p/205840#M59867 chimell 2016-02-17T09:52:01Z