Getting Data In

how to calculate and get the statistical table for today vs yesterday vs last7days volume

selvam_sekar
Path Finder
 
Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @selvam_sekar,

did you explored the timewrap command at https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Timewrap ?

Ciao.

Giuseppe

0 Karma

selvam_sekar
Path Finder

thanks @gcusello . Could you help me with below asks?

when we run the base query without timewrap, the todays count is only 6 and yesterday count us 19.

But, when we run the base query with timewrap the todays total is 25 and yesterday total is 13. 

Splunk Query:

basesearch earliest=-7d@d latest=now()
| timechart span=1h count
| timewrap d series=short
| addtotals s*
| eval 7dayavg=Total/7.0
| table _time, s0, s1, Total, 7dayavg
| rename s0 as Today, s1 as yesterday

Results:

_time Today yesterday Total 7dayavg

2024-01-31 08:000000.0
2024-01-31 09:000000.0
2024-01-31 10:002040.57
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...