All Apps and Add-ons

Same hour for the last 7 days

Communicator

Hi,

I would like to compare the same hour for the last seven days. Is there a chance of using timewrap for this?

cheers,
Andy

Tags (1)
1 Solution

SplunkTrust
SplunkTrust

Hi kochera,

Yes, you can use timewrap for this. Take a look at this run everywhere example:

index=_internal earliest=-7d@d latest=-0d@d source=*metrics.log | timechart span=1h sum(kb) by series | timewrap w | where strftime(_time, "%H") == "10"

This will get you a nice chart of the sum for kb per series out of the metrics.log and compares the results for each day at hour 10 over the last 7 days.

hope this helps ... and @carasso can agree on this ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi kochera,

Yes, you can use timewrap for this. Take a look at this run everywhere example:

index=_internal earliest=-7d@d latest=-0d@d source=*metrics.log | timechart span=1h sum(kb) by series | timewrap w | where strftime(_time, "%H") == "10"

This will get you a nice chart of the sum for kb per series out of the metrics.log and compares the results for each day at hour 10 over the last 7 days.

hope this helps ... and @carasso can agree on this ...

cheers, MuS

View solution in original post

Champion

Kristian's one will be efficient as it will get all the required values before creating the chart.

0 Karma

Ultra Champion

You might even make do with using the date_* default fields;

index=_internal earliest=-7d@d date_hour=10 | stats c by date_mday

It all depends on how you want to process and report on your data.
/k

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!