I just started to use Timewrap and I am having an issue with the displayed week label. I am trying to show the time chart for today and the same day last week only. In date terms, I want to only show June 17 (today) and June 10 (last Friday).
My search is:
data=device earliest=-2w | timechart count span=1h | where strftime(_time, "%A") == strftime(now(),"%A") | timewrap w series=exact|
When the search completes, the chart line labels read the week of June 10 and the week of June 03. There isn't a label for the week of June 17th (which is today). Also, how do I change the exact label to be the Day, not the "week of"
All help is appreciated
Can you try this?
data=device earliest=-14d@d | timechart count span=1d | where strftime(_time, "%A") == strftime(now(),"%A") | timewrap d series=exact|
if you use
earliest=w, the least data point Splunk picks is a week. Since you need at a day level, try using
Hope this helps
the timewrap d definitely gives me that date that i was looking for but it still give me data for Yesterday (june 19) and last week (june 13).
What i am trying to show is always the Current Day and the Same Day the previous week. I don't want Yesterday and Yesterday's same day the previous week. I have tried
Any ideas on how to show Today in timewrap?
and still get Yesterday as the
index=_internal earliest=-13d latest=now | timechart count span=1d| where strftime(_time, "%A") == strftime(now(),"%A") | timewrap d series=relative|rename latest_day as today_thisweek|rename 7days_before as today_previousweek
Hope this helps!
Change it as per your need...You can also rename the two data points
I think this is the answer i was looking for and it doesn't use Timewrap.
data=device latest=now earliest=@d |stats sum(total_amount) AS Today by device_type | appendcols [search latest=-7d@m earliest=-7d@d|stats sum(total_amount) AS Last_Week by device_type ]
This allows me to compare to the exact same Today to Last week, to the Minute. I just couldn't get to the level I wanted with Timewrap at this time. It's a great command, but I think I just need to experiment with it more.
That will work very well...I thought you wanted to achieve the search using time wrap:)
If time wrap is not a mandate, you can try this which is also faster when need to look for longer range comparisons