Deployment Architecture

data to display on the latest event of a week.

DataOrg
Builder

i have 5 weeks of data and data is collected only once in a week. if sometime in a week the script is triggered twice there will cause a duplicate entry but it will not happen every week.
i want to display data "ALL time" but i want to pick and display the latest event indexed in each week in the span of 1 week and i want the span to pick data from Saturday to Friday.

1 Solution

whrg
Motivator

Hi! My thoughts are this:
First, you calculate the week number. You need to add a day (86400 seconds) to _time because in your case the week starts with a Saturday.
Next, you calculate the latest timestamp for each week number using eventstats.
Last, you filter for latest timestamps per week.

| your base search
| eval weeknumber=strftime(_time+86400,"%U")
| eventstats latest(_time) as latest_time_by_week by weeknumber
| where _time=latest_time_by_week

View solution in original post

whrg
Motivator

Hi! My thoughts are this:
First, you calculate the week number. You need to add a day (86400 seconds) to _time because in your case the week starts with a Saturday.
Next, you calculate the latest timestamp for each week number using eventstats.
Last, you filter for latest timestamps per week.

| your base search
| eval weeknumber=strftime(_time+86400,"%U")
| eventstats latest(_time) as latest_time_by_week by weeknumber
| where _time=latest_time_by_week

inventsekar
SplunkTrust
SplunkTrust

Do you have some sample data/logs please?

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

DataOrg
Builder

@inventsekar
sample data

ID   SITENAME   desc    line1   line2   line3   TIMESTAMP   _time
1    abc      horlicks    1 1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.647
2   abc     boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.648
3   abc complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.649
4   abc horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.650
5   abc boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.651
6   bbc complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.652
7   bbc horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.653
8   bbc boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.654
9   bbc complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.655
10  bbc horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.656
11  ccd boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.657
12  ccd complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.658
13  ccd horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.659
14  ccd boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.660
15  ccd complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.661

i want results to be displayed like. host sum(line1) sum(line 2) sum(line3)
host line1 line2 line3
abc 10 11 14
bbc 12 52 60
ccd

0 Karma

DataOrg
Builder

@mstjohn_splunk . help needed

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...