Splunk Search

How can I use tstats to search event count comparing with last week a the same time

splunk_pn
Explorer

I have a search that works with stats - but fail to work when using tstats..

Here is the search with stats:

index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w | stats count by host | rename count as LastWeek
| appendcols [search index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m | stats count by host | rename count as Today] 
| table host Today LastWeek

Since this search take some time - I thought that I should use tstats instead - but some how I can't make it work. The individual
searches works - but not combined as subsearch as in this example:

| tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w by host | rename count as LastWeek
| appendcols [search [|tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m by host | rename count as Today]]
| table host LastWeek Today

In this search it only returns values for "LastWeek" - nothing for "Today", but the individual searches with tstast works without problems.

Anyone with a clue?

1 Solution

myriadic
Path Finder

The

[search [|tstats

is seeing

|tstats

as a subsearch of an empty subsearch. Remove the

[search...]

and it should work:

| tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w by host | rename count as LastWeek
| appendcols [|tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m by host | rename count as Today]
| table host LastWeek Today

View solution in original post

splunk_pn
Explorer

Ok, thank you!
I knew it was something simple - sometimes you need someone else eyes - to see the obvious...

Thanka, again.

0 Karma

myriadic
Path Finder

The

[search [|tstats

is seeing

|tstats

as a subsearch of an empty subsearch. Remove the

[search...]

and it should work:

| tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w by host | rename count as LastWeek
| appendcols [|tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m by host | rename count as Today]
| table host LastWeek Today

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...