All Apps and Add-ons

How to I get the total amount per day or per week ?

dfigurello
Communicator

Hey Splunkers,

I'm using the timewrap and I'm wondering how can I get the total amount per day instead of the average per day? For exemple: I want to know how much the company sold on Monday, to compare with the sales of last Monday...

Could you help about that?

Tks.

1 Solution

carasso
Splunk Employee
Splunk Employee

Your example sounds like you want to compare one Monday to the previous Monday.

Try this:

Do your search as usual, and filter at the end (filtering up-front will confuse timechart):

.... 
| timechart count span=1h 
| timewrap w 
| where strftime(_time, "%A") == "Monday"

View solution in original post

carasso
Splunk Employee
Splunk Employee

Your example sounds like you want to compare one Monday to the previous Monday.

Try this:

Do your search as usual, and filter at the end (filtering up-front will confuse timechart):

.... 
| timechart count span=1h 
| timewrap w 
| where strftime(_time, "%A") == "Monday"

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi dfigurello,

based on the answer by caraaso this works like this:

YourSearchHere  earliest=-1w@w
| timechart <insert your search commands to get your event results> span=1h
| timewrap  d series=short
| addtotals s*
| table _time, _span, s1, s8
| rename s1 as last_Monday, s8 as this_Monday

This will search YourSearchHere starting at the start of the week before (-1w@w), then you will timechart your events to your needs so you get your sales numbers, timewrap it and addtotals. After that you show, according to your question, this Monday and last Monday results with the table command and rename s1 and s8 to human readable names.

I did test it with the index=_internal and it worked, so don't blame me if it will not work with your events 😉

hope this helps ...

cheers, MuS

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.