topic Re: How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week? in Splunk Search

How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week?

vrmandadi — Wed, 06 Apr 2016 21:12:56 GMT

Hello,

I am trying to compare the count for Tuesday of last week with Tuesday of this week. I am currently using the below search to compare the results:

index=d earliest=@w2 latest=now
| eval Period=if( _time

Re: How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week?

arobbins_splunk — Wed, 06 Apr 2016 21:41:58 GMT

how about:

index=_internal earliest=-14d date_wday="tuesday"
| eval day=date_month." ".date_mday
| stats count by day

by putting the filtering for date_wday in the initial search, you won't retrieve any extraneous events

Re: How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week?

vrmandadi — Wed, 06 Apr 2016 21:54:44 GMT

Thank You arobbins ,It worked with just a small change in my query

Re: How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week?

woodcock — Wed, 06 Apr 2016 22:00:35 GMT

You need the timewrap app:

https://splunkbase.splunk.com/app/1645/

Re: How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week?

somesoni2 — Wed, 06 Apr 2016 22:03:35 GMT

Give this a try (check the rex messages)

index=d " earliest=-14d date_wday=Tuesday
| eval day=if(_time>relative_time(now(),"-7d"),"ThisWeek","LastWeek")
 | rex field=EWS_MESSAGE_QUALIFIER "(?\w+)" | rex field=ews_transaction_log.ews_message_qualifier "(?\w+)" 
 | chart count by MESSAGE_TYPE,day

If date_wday is not already present

index=d " earliest=-14d@d | where strftime(_time,"%a")="Tue"     | eval day=if(_time>relative_time(now(),"-7d"),"ThisWeek","LastWeek")
 | rex field=EWS_MESSAGE_QUALIFIER "(?\w+)" | rex field=ews_transaction_log.ews_message_qualifier "(?\w+)" 
 | chart count by MESSAGE_TYPE,day

Re: How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week?

vrmandadi — Tue, 29 Sep 2020 09:22:08 GMT

It worked thanks a lot,but please explain me

what will this below search does

eval day=if(_time>relative_time(now(),"-7d")

Re: How to edit my search to compare the count for Tuesday of the present week with Tuesday of the previous week?

somesoni2 — Wed, 06 Apr 2016 22:29:39 GMT

This is differentiating between two Tuesday that you'll get in the results. If the timestamp of the events is within last 7 days they are from the Tuesday just passed. If you run the query on or after Wednesday it'll give Tuesday of current week else it will give Tuesday of last week.