Splunk Search

How can I use tstats to search event count comparing with last week a the same time

splunk_pn
Explorer

I have a search that works with stats - but fail to work when using tstats..

Here is the search with stats:

index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w | stats count by host | rename count as LastWeek
| appendcols [search index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m | stats count by host | rename count as Today] 
| table host Today LastWeek

Since this search take some time - I thought that I should use tstats instead - but some how I can't make it work. The individual
searches works - but not combined as subsearch as in this example:

| tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w by host | rename count as LastWeek
| appendcols [search [|tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m by host | rename count as Today]]
| table host LastWeek Today

In this search it only returns values for "LastWeek" - nothing for "Today", but the individual searches with tstast works without problems.

Anyone with a clue?

1 Solution

myriadic
Path Finder

The

[search [|tstats

is seeing

|tstats

as a subsearch of an empty subsearch. Remove the

[search...]

and it should work:

| tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w by host | rename count as LastWeek
| appendcols [|tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m by host | rename count as Today]
| table host LastWeek Today

View solution in original post

splunk_pn
Explorer

Ok, thank you!
I knew it was something simple - sometimes you need someone else eyes - to see the obvious...

Thanka, again.

0 Karma

myriadic
Path Finder

The

[search [|tstats

is seeing

|tstats

as a subsearch of an empty subsearch. Remove the

[search...]

and it should work:

| tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m-1w latest=@m-1w by host | rename count as LastWeek
| appendcols [|tstats count where index=wineventlog sourcetype="xmlwineventlog:security" earliest=-15m@m latest=@m by host | rename count as Today]
| table host LastWeek Today

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...