Splunk Search

Compare total by today with yesterday and against the 7dayavg for the last week

demkic
Explorer

I have the following query where I am trying to utilize timewrap to display the total number of credit cards used as a payment method today, yesterday, and compare it to the 7 day average.

base search...
| payment_method=credit_card 
    | timechart count span=1h 
    | timewrap d series=short
    | addtotals s* 
    | eval 7dayavg=Total/7.0 
    | table _time, _span, s0, s1, 7dayavg 
    | rename s0 as now, s1 as yesterday

The problem is currently that the legend shows 4 data series labeled 6:00 PM - 12:00 AM, 12:00 AM - 6:00 AM, 6:00 AM - 12:00 PM, 12:00 PM - 6:00 PM when I would like for it to be today, yesterday, and 7dayavg. The x-axis barely starts from 6:00 pm however I would like it to start from the beginning of the day today (midnight) compared to the beginning of the day yesterday (midnight), with the 7 day average at midnight.

Thank you

0 Karma

john_q
Explorer

In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

It's giving you that because you have fed it data at the hourly basis, so it is assuming you care about hours. If you are trying to calculate on a daily basis, rather than hourly, change this line -

 | timechart count span=1h 

to

 | timechart count span=1d 
0 Karma

demkic
Explorer

Thank you for your response. I realize I wasn't very clear in my question. To clarify, I am using the custom timewrap extension and would like a graph to display on the x-axis the hours against today, yesterday, and the 7-day average.

Essentially, I would see three lines going across with a data point at each hour (01, 02, 03, 04...- .. 22, 23).

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...