How to show last weeks data in trellis for single value visualization?

[mukhil]

Hi,

Im working on showing last week data in trellis for single value visualization. I have 7 values in trellis which is showing current week's data. I would like to see last week data as well in form of providing token to it, but unable to perform. Please help me in it.

[woodcock]

You need the timewrap command:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap

[jodyfsu]

I think you might be looking for something like this:

index=INDEX sourcetype=SOURCETYPE "REST OF SEARCH"
 earliest=-8d@d latest=-1d@d 
| multikv 
| eval ReportKey="Last Week" 
| append 
    [ search index=INDEX sourcetype=SOURCETYPE "REST OF SEARCH"
 earliest=-15d@d latest=-8d@d
    | multikv 
    | eval ReportKey="Previous Week" 
    | eval _time=_time+60*60*24*7] 
| stats FUNCTION by ReportKey 

I use this to compare weeks without having to do each week manually.

[woodcock]

Just stack the time specifiers like this:

index=?INDEX sourcetype=SOURCETYPE "REST OF SEARCH" (earliest=-8d@d latest=-1d@d OR earliest=-15d@d latest=-8d@d)
| multikv
| timechart span=1w FUNCTION