All Apps and Add-ons

How can I graph today vs yesterday vs the weekly average?

carasso
Splunk Employee
Splunk Employee

this was asked by a customer. I'm repeating it so others can see the answer...

1 Solution

carasso
Splunk Employee
Splunk Employee

Step 1) get the Timewrap app, which adds a new "timewrap" search command.

Step 2) Search for the last 7 days and run this:

*  
| timechart count span=1h
| timewrap  d series=short
| addtotals s*
| eval 7dayavg=Total/7.0
| table _time, _span, s0, s1, 7dayavg
| rename s0 as now, s1 as yesterday

Basically, we're using timewrap over the last 7 days, and then using addtotals and eval to calculate the average over those 7 days. We then rename fields and cut out days 3-7, because we only wanted today, yesterday, and the weekly average.

View solution in original post

carasso
Splunk Employee
Splunk Employee

Step 1) get the Timewrap app, which adds a new "timewrap" search command.

Step 2) Search for the last 7 days and run this:

*  
| timechart count span=1h
| timewrap  d series=short
| addtotals s*
| eval 7dayavg=Total/7.0
| table _time, _span, s0, s1, 7dayavg
| rename s0 as now, s1 as yesterday

Basically, we're using timewrap over the last 7 days, and then using addtotals and eval to calculate the average over those 7 days. We then rename fields and cut out days 3-7, because we only wanted today, yesterday, and the weekly average.

Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...