All Apps and Add-ons

Same hour for the last 7 days

kochera
Communicator

Hi,

I would like to compare the same hour for the last seven days. Is there a chance of using timewrap for this?

cheers,
Andy

Tags (1)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi kochera,

Yes, you can use timewrap for this. Take a look at this run everywhere example:

index=_internal earliest=-7d@d latest=-0d@d source=*metrics.log | timechart span=1h sum(kb) by series | timewrap w | where strftime(_time, "%H") == "10"

This will get you a nice chart of the sum for kb per series out of the metrics.log and compares the results for each day at hour 10 over the last 7 days.

hope this helps ... and @carasso can agree on this ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi kochera,

Yes, you can use timewrap for this. Take a look at this run everywhere example:

index=_internal earliest=-7d@d latest=-0d@d source=*metrics.log | timechart span=1h sum(kb) by series | timewrap w | where strftime(_time, "%H") == "10"

This will get you a nice chart of the sum for kb per series out of the metrics.log and compares the results for each day at hour 10 over the last 7 days.

hope this helps ... and @carasso can agree on this ...

cheers, MuS

View solution in original post

linu1988
Champion

Kristian's one will be efficient as it will get all the required values before creating the chart.

0 Karma

kristian_kolb
Ultra Champion

You might even make do with using the date_* default fields;

index=_internal earliest=-7d@d date_hour=10 | stats c by date_mday

It all depends on how you want to process and report on your data.
/k

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!