cron schedule on past 7 days search

[kokanne]

Hello,

I applied a scheduled search to one of my reports that counts the MB usage of the past 7 days, and compares it to the 7 days prior to that.

It was indicating around 6000 with a trendline of +120%
After applying the schedule, it is indicating 413 with a decrease of -83%

Now this is weird, how is it possible that the cron schedule altered the outcome?

It is schedule to refresh every 30 minutes

[ypeng_splunk]

Pls post the savedsearches.conf

[damiensurat]

Could you please share the cron expression and time range for the scheduled search?

[kokanne]

Dont have access to this

[ypeng_splunk]

then post the search.

[somesoni2]

Along with time range used.

[kokanne]

search:

index="network" sourcetype="network:proxy" 
| timechart span=1h eval(sum(bytes)/1024/1024) as totMBs

Time range 7 days
Visual is single value compared to 7 days before

[Richfez]

I think those settings might make a single-value visualization (lol, which has two values on it!) compare the most recent hour with the previous hour? Your results would seem to sort of possibly fit with that.

So try this:

index="network" sourcetype="network:proxy" earliest=-2w@w 
| timechart span=1w eval(sum(bytes)/1024/1024) as totMBs

Keep in mind that compares the last full week's data to this week so far, which could be only the first days's worth of data from this week.

Better, perhaps, may be to press timewrap into service? The Usage and Basic Example section is pretty close to what you need, just that you have a slightly different base search.