Splunk Search

How do I change earliest and latest times on the relative_time to compare the historic results instead of the current?

pavanae
Builder

Hi,

I have a Splunk query as below which does a comparison between this week's hosts and last week's hosts

index="summary" search_name="query_1" earliest=-1w@w latest=now
 | bucket span=1w _time 
 | stats values(_time) as weeks by my_hostname
| eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week") | search remark="Present this week but not last week" | stats count

Right now, I can only do the comparison between current week's hosts and last week's hosts

Now, how do I change the earliest and latest times in my query to compare the last week's hosts to before last week hosts and so on?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can look into timewrap or use relative_time to accomplish this. If you choose the latter, what you'll need to do is remove that earliest and latest constraint on your top line, then create a new field for this week and capture the time for this week and create another field for last week and capture the timerange for that. Then you can expand the overall timerange for last week to now and run a timechart and split by both fields to do the comparison.

0 Karma

pavanae
Builder

@skoelpin. There is no timewrap app on our environment so my only other option is relative_time. Could you update the query by using the relative_time command for the earliest and latest times for last week and before last week.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

What version of Splunk are you running? Should be a standard command on the later versions

index="summary" search_name="query_1" 
  | timechart span=1w count by my_hostname
  | timewrap 1d

Will update later with the query

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@pavanae,

If your earliest & latest from the eval then you can use sub search. like

index=main [ YOUR EVAL FOR earliest latest | table earliest latest | format "(" "(" "" ")" "OR" ")"  | table search ]
0 Karma

skoelpin
SplunkTrust
SplunkTrust

This will be an expensive search, always better to avoid subsearches when possible

0 Karma

pavanae
Builder

@kamlesh_vaghela. what could be my search if I my earliest is 2 weeks back and latest is 1 week back.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@pavanae,

Your search would be like this.

index=main [ | makeresults | eval earliest=relative_time(now(),"-2w@w"), latest=relative_time(now(),"-1w@w")  | table earliest latest | format "(" "(" "" ")" "OR" ")"  | table search]

Try and let me know.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@pavanae,

Did you try

earliest=-2w@w latest=-1w@w
Happy Splunking!
0 Karma

pavanae
Builder

@renjith.nair. Yes I did. but I also need to change the time on my eval conditions which I'm not sure how to modify it?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...