Archive
Highlighted

compare today statistic with to day from last week

Explorer

Dears,

i want to compare today statistic with the day from last week how can I do that

thank in advance

Tags (1)
0 Karma
Highlighted

Re: compare today statistic with to day from last week

SplunkTrust
SplunkTrust

Hi ahmedhassanean,

try this run everywhere search as admin:

| tstats count WHERE earliest=-7d@d latest=now index=_internal by host, sourcetype, _time 
| bucket _time span=1d 
| stats last(_time) AS last_time sum(count) AS per_day_count by _time, host, sourcetype 
| eval last_week = if(last_time > exact(relative_time(now(),"-8d@d")) AND last_time <= exact(relative_time(now(),"-7d@d")) , per_day_count ,"0") 
| eval today = if(last_time > exact(relative_time(now(),"-1d@d")) AND last_time <= exact(relative_time(now(),"-0d@d")) , per_day_count ,"0") 
| stats sum(today) AS today sum(last_week) AS last_week by host

It will show you one way to do it by using stats and counting based on the time of the events. Another way can be using the timewrap command https://splunkbase.splunk.com/app/1645/ which should be available on Splunk cloud.

Hope this helps ...

cheers, MuS

0 Karma
Highlighted

Re: compare today statistic with to day from last week

Explorer

first many thanks for your support but i already have checked timewrap but what i want to compare for example SPL that end with below .SPL .... | timechart span=1h sum(stats) with same set of any day from last week

0 Karma
Highlighted

Re: compare today statistic with to day from last week

SplunkTrust
SplunkTrust

As I have written, it shows how it can be done. If the end result does not macho your needs, adapt the search.

0 Karma