Dashboards & Visualizations

How to show last weeks data in trellis for single value visualization?

mukhil
New Member

Hi,

Im working on showing last week data in trellis for single value visualization. I have 7 values in trellis which is showing current week's data. I would like to see last week data as well in form of providing token to it, but unable to perform. Please help me in it.

0 Karma

woodcock
Esteemed Legend
0 Karma

jodyfsu
Path Finder

I think you might be looking for something like this:

index=INDEX sourcetype=SOURCETYPE "REST OF SEARCH"
 earliest=-8d@d latest=-1d@d 
| multikv 
| eval ReportKey="Last Week" 
| append 
    [ search index=INDEX sourcetype=SOURCETYPE "REST OF SEARCH"
 earliest=-15d@d latest=-8d@d
    | multikv 
    | eval ReportKey="Previous Week" 
    | eval _time=_time+60*60*24*7] 
| stats FUNCTION by ReportKey 

I use this to compare weeks without having to do each week manually.

0 Karma

woodcock
Esteemed Legend

Just stack the time specifiers like this:

index=?INDEX sourcetype=SOURCETYPE "REST OF SEARCH" (earliest=-8d@d latest=-1d@d OR earliest=-15d@d latest=-8d@d)
| multikv
| timechart span=1w FUNCTION
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.