Splunk Search

Compare week and last week by host

nravichandran
Communicator

I am trying to improve on the query below to show timechart by host for last week and this week. When I do "by host" it is not showing last week comparision. here is the query:
sourcetype=permon host="abc*" earliest=-2w@w latest=@w|eval marker = if(_time < relative_time(now(),"-1w@w"),"last week","this week")|eval _time = if(marker == "last week", _time + 7*24*60*60,_time) | timechart span=15m avg(PercentProcessorTime) as AvgPercentProcessorTime by marker (here how to do by host and by marker)

Tags (1)
0 Karma

nravichandran
Communicator

Unfortunately I cannot use timewrap as I cannot import the app. Is there any other way to get the desired result?

0 Karma

woodcock
Esteemed Legend
0 Karma

nravichandran
Communicator

Unfortunately I cannot use this app as I am a normal user of splunk in my organization.

0 Karma

woodcock
Esteemed Legend

Even if you cannot use the app, you can download it and look at the code, searches, macros, etc. and learn how it works. It is actually somewhat complicated to do what you are trying to do and look at how Timewrap works will be a huge help in you getting it done, even without being able to install it. Also, depending on what privileges you do have, you might very well be able to recreate the app by copying and adding all of the Knowledge Objects by hand.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!