Splunk Search

Compare week and last week by host

nravichandran
Communicator

I am trying to improve on the query below to show timechart by host for last week and this week. When I do "by host" it is not showing last week comparision. here is the query:
sourcetype=permon host="abc*" earliest=-2w@w latest=@w|eval marker = if(_time < relative_time(now(),"-1w@w"),"last week","this week")|eval _time = if(marker == "last week", _time + 7*24*60*60,_time) | timechart span=15m avg(PercentProcessorTime) as AvgPercentProcessorTime by marker (here how to do by host and by marker)

Tags (1)
0 Karma

nravichandran
Communicator

Unfortunately I cannot use timewrap as I cannot import the app. Is there any other way to get the desired result?

0 Karma

woodcock
Esteemed Legend
0 Karma

nravichandran
Communicator

Unfortunately I cannot use this app as I am a normal user of splunk in my organization.

0 Karma

woodcock
Esteemed Legend

Even if you cannot use the app, you can download it and look at the code, searches, macros, etc. and learn how it works. It is actually somewhat complicated to do what you are trying to do and look at how Timewrap works will be a huge help in you getting it done, even without being able to install it. Also, depending on what privileges you do have, you might very well be able to recreate the app by copying and adding all of the Knowledge Objects by hand.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...