All Apps and Add-ons

How can I graph today vs yesterday vs the weekly average?

carasso
Splunk Employee
Splunk Employee

this was asked by a customer. I'm repeating it so others can see the answer...

1 Solution

carasso
Splunk Employee
Splunk Employee

Step 1) get the Timewrap app, which adds a new "timewrap" search command.

Step 2) Search for the last 7 days and run this:

*  
| timechart count span=1h
| timewrap  d series=short
| addtotals s*
| eval 7dayavg=Total/7.0
| table _time, _span, s0, s1, 7dayavg
| rename s0 as now, s1 as yesterday

Basically, we're using timewrap over the last 7 days, and then using addtotals and eval to calculate the average over those 7 days. We then rename fields and cut out days 3-7, because we only wanted today, yesterday, and the weekly average.

View solution in original post

carasso
Splunk Employee
Splunk Employee

Step 1) get the Timewrap app, which adds a new "timewrap" search command.

Step 2) Search for the last 7 days and run this:

*  
| timechart count span=1h
| timewrap  d series=short
| addtotals s*
| eval 7dayavg=Total/7.0
| table _time, _span, s0, s1, 7dayavg
| rename s0 as now, s1 as yesterday

Basically, we're using timewrap over the last 7 days, and then using addtotals and eval to calculate the average over those 7 days. We then rename fields and cut out days 3-7, because we only wanted today, yesterday, and the weekly average.

Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...