Splunk Search

Compare total by today with yesterday and against the 7dayavg for the last week


I have the following query where I am trying to utilize timewrap to display the total number of credit cards used as a payment method today, yesterday, and compare it to the 7 day average.

base search...
| payment_method=credit_card 
    | timechart count span=1h 
    | timewrap d series=short
    | addtotals s* 
    | eval 7dayavg=Total/7.0 
    | table _time, _span, s0, s1, 7dayavg 
    | rename s0 as now, s1 as yesterday

The problem is currently that the legend shows 4 data series labeled 6:00 PM - 12:00 AM, 12:00 AM - 6:00 AM, 6:00 AM - 12:00 PM, 12:00 PM - 6:00 PM when I would like for it to be today, yesterday, and 7dayavg. The x-axis barely starts from 6:00 pm however I would like it to start from the beginning of the day today (midnight) compared to the beginning of the day yesterday (midnight), with the 7 day average at midnight.

Thank you

0 Karma


In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount

0 Karma


It's giving you that because you have fed it data at the hourly basis, so it is assuming you care about hours. If you are trying to calculate on a daily basis, rather than hourly, change this line -

 | timechart count span=1h 


 | timechart count span=1d 
0 Karma


Thank you for your response. I realize I wasn't very clear in my question. To clarify, I am using the custom timewrap extension and would like a graph to display on the x-axis the hours against today, yesterday, and the 7-day average.

Essentially, I would see three lines going across with a data point at each hour (01, 02, 03, 04...- .. 22, 23).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...