Splunk Search

Compare total by today with yesterday and against the 7dayavg for the last week

demkic
Explorer

I have the following query where I am trying to utilize timewrap to display the total number of credit cards used as a payment method today, yesterday, and compare it to the 7 day average.

base search...
| payment_method=credit_card 
    | timechart count span=1h 
    | timewrap d series=short
    | addtotals s* 
    | eval 7dayavg=Total/7.0 
    | table _time, _span, s0, s1, 7dayavg 
    | rename s0 as now, s1 as yesterday

The problem is currently that the legend shows 4 data series labeled 6:00 PM - 12:00 AM, 12:00 AM - 6:00 AM, 6:00 AM - 12:00 PM, 12:00 PM - 6:00 PM when I would like for it to be today, yesterday, and 7dayavg. The x-axis barely starts from 6:00 pm however I would like it to start from the beginning of the day today (midnight) compared to the beginning of the day yesterday (midnight), with the 7 day average at midnight.

Thank you

0 Karma

john_q
Explorer

In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount

0 Karma

DalJeanis
Legend

It's giving you that because you have fed it data at the hourly basis, so it is assuming you care about hours. If you are trying to calculate on a daily basis, rather than hourly, change this line -

 | timechart count span=1h 

to

 | timechart count span=1d 
0 Karma

demkic
Explorer

Thank you for your response. I realize I wasn't very clear in my question. To clarify, I am using the custom timewrap extension and would like a graph to display on the x-axis the hours against today, yesterday, and the 7-day average.

Essentially, I would see three lines going across with a data point at each hour (01, 02, 03, 04...- .. 22, 23).

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...