Splunk Search

How can I concatenate tables from the same search at different time periods ?

Clovisa
Path Finder

Hi, I am trying to compare the top sales of the latest week to the top sales of the previous week.
I am trying to get a table that looks like :

Product   | Rank    | Rank previous week
Table     | 1       | 2
Chair     | 2       | 1

index=sales earliest=-2w latest=-w
| stats count as Sales by Product| sort -Sales
| table Product
| streamstats count as Rank

I succeeded in having the latest rank or the previous rank (see query above) but I don't see how I can combine them. Do you know how I could do this ? Thanks !

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

Hi @Clovisa,

Try

index=sales earliest=-2w latest=@w|bucket span=1w _time
 |stats count as Sales by Product,_time|sort _time,-count
 |streamstats count as rank by _time
 |sort Product
 |streamstats current=f last(rank) as prev_rank by Product reset_on_change=true|where prev_rank!=""
 |table Product,rank,prev_rank|sort rank
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

View solution in original post

renjith_nair
Legend

Hi @Clovisa,

Try

index=sales earliest=-2w latest=@w|bucket span=1w _time
 |stats count as Sales by Product,_time|sort _time,-count
 |streamstats count as rank by _time
 |sort Product
 |streamstats current=f last(rank) as prev_rank by Product reset_on_change=true|where prev_rank!=""
 |table Product,rank,prev_rank|sort rank
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

Clovisa
Path Finder

It is perfect, thanks a lot :grinning_face_with_smiling_eyes:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...