Splunk Search

Compare total by today with yesterday and against the 7dayavg for the last week

demkic
Explorer

I have the following query where I am trying to utilize timewrap to display the total number of credit cards used as a payment method today, yesterday, and compare it to the 7 day average.

base search...
| payment_method=credit_card 
    | timechart count span=1h 
    | timewrap d series=short
    | addtotals s* 
    | eval 7dayavg=Total/7.0 
    | table _time, _span, s0, s1, 7dayavg 
    | rename s0 as now, s1 as yesterday

The problem is currently that the legend shows 4 data series labeled 6:00 PM - 12:00 AM, 12:00 AM - 6:00 AM, 6:00 AM - 12:00 PM, 12:00 PM - 6:00 PM when I would like for it to be today, yesterday, and 7dayavg. The x-axis barely starts from 6:00 pm however I would like it to start from the beginning of the day today (midnight) compared to the beginning of the day yesterday (midnight), with the 7 day average at midnight.

Thank you

0 Karma

john_q
Explorer

In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

It's giving you that because you have fed it data at the hourly basis, so it is assuming you care about hours. If you are trying to calculate on a daily basis, rather than hourly, change this line -

 | timechart count span=1h 

to

 | timechart count span=1d 
0 Karma

demkic
Explorer

Thank you for your response. I realize I wasn't very clear in my question. To clarify, I am using the custom timewrap extension and would like a graph to display on the x-axis the hours against today, yesterday, and the 7-day average.

Essentially, I would see three lines going across with a data point at each hour (01, 02, 03, 04...- .. 22, 23).

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...