https://community.splunk.com/t5/Splunk-Search/How-to-track-the-count-of-IP-addresses-on-each-server-week-over/m-p/262732#M78867 <P>Your search will look something like this</P> <PRE><CODE> index=foo sourcetype=bar earliest=-4w@w | eval wk=case(relative_time(_time, "-1w@w")&lt;_time, "This Week", relative_time(_time, "-2w@w")&lt;_time AND relative_time(_time, "-1w@w")&gt;_time, "1 week", and so on and so forth | chart count over server by wk </CODE></PRE> Tue, 24 May 2016 14:39:29 GMT sundareshr 2016-05-24T14:39:29Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-count-of-IP-addresses-on-each-server-week-over/m-p/262731#M78866 <P>I need to see how many IP addresses are on each server for the current week, last week, 2 weeks ago, and 3 weeks ago. This needs to be tracked week over week and display a total of 4 weeks, like in the example below. </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1389i67B6F4FCA85A2D4C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 24 May 2016 12:57:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-count-of-IP-addresses-on-each-server-week-over/m-p/262731#M78866 skolsto 2016-05-24T12:57:59Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-count-of-IP-addresses-on-each-server-week-over/m-p/262732#M78867 <P>Your search will look something like this</P> <PRE><CODE> index=foo sourcetype=bar earliest=-4w@w | eval wk=case(relative_time(_time, "-1w@w")&lt;_time, "This Week", relative_time(_time, "-2w@w")&lt;_time AND relative_time(_time, "-1w@w")&gt;_time, "1 week", and so on and so forth | chart count over server by wk </CODE></PRE> Tue, 24 May 2016 14:39:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-count-of-IP-addresses-on-each-server-week-over/m-p/262732#M78867 sundareshr 2016-05-24T14:39:29Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-count-of-IP-addresses-on-each-server-week-over/m-p/262733#M78868 <P>Also, look at Time wrap app <A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> <P><A href="http://blogs.splunk.com/2013/12/04/comparing-week-over-week-results/">http://blogs.splunk.com/2013/12/04/comparing-week-over-week-results/</A></P> Tue, 24 May 2016 15:16:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-count-of-IP-addresses-on-each-server-week-over/m-p/262733#M78868 somesoni2 2016-05-24T15:16:14Z