Splunk Search

Compare week and last week by host

nravichandran
Communicator

I am trying to improve on the query below to show timechart by host for last week and this week. When I do "by host" it is not showing last week comparision. here is the query:
sourcetype=permon host="abc*" earliest=-2w@w latest=@w|eval marker = if(_time < relative_time(now(),"-1w@w"),"last week","this week")|eval _time = if(marker == "last week", _time + 7*24*60*60,_time) | timechart span=15m avg(PercentProcessorTime) as AvgPercentProcessorTime by marker (here how to do by host and by marker)

Tags (1)
0 Karma

nravichandran
Communicator

Unfortunately I cannot use timewrap as I cannot import the app. Is there any other way to get the desired result?

0 Karma

woodcock
Esteemed Legend
0 Karma

nravichandran
Communicator

Unfortunately I cannot use this app as I am a normal user of splunk in my organization.

0 Karma

woodcock
Esteemed Legend

Even if you cannot use the app, you can download it and look at the code, searches, macros, etc. and learn how it works. It is actually somewhat complicated to do what you are trying to do and look at how Timewrap works will be a huge help in you getting it done, even without being able to install it. Also, depending on what privileges you do have, you might very well be able to recreate the app by copying and adding all of the Knowledge Objects by hand.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...