Dashboards & Visualizations

How to form a trend table for events

mrigank517
New Member

I want to have a search for a particular keyword say "error" being calculated from the events and the output should be in the form of table which shows the count for the particular event for last 7 days and last 30 days.

Tags (2)
0 Karma
1 Solution

Sukisen1981
Champion

append will add the sub search as a row entry, and eval works on a event row basis, so ideally you should not receive any output by using thsi query. Try this :
index=xxx error earliest=-30d@d latest=@d | stats count AS thirty_days | appendcols [ search earliest=-7d@d latest=@d | stats count AS seven_days] | eval rate=((seven_days/thirty_days)*100) |table rate

View solution in original post

0 Karma

Sukisen1981
Champion

append will add the sub search as a row entry, and eval works on a event row basis, so ideally you should not receive any output by using thsi query. Try this :
index=xxx error earliest=-30d@d latest=@d | stats count AS thirty_days | appendcols [ search earliest=-7d@d latest=@d | stats count AS seven_days] | eval rate=((seven_days/thirty_days)*100) |table rate

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

mrigank517
New Member

index=xxx error earliest=-30d@d latest=@d | stats count AS "thirty_days" | append [ search earliest=-7d@d latest=@d | stats count AS "seven_days"] | eval rate=((seven_days/thirty_days)*100) |table rate

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!