How do I change earliest and latest times on the relative_time to compare the historic results instead of the current?

[pavanae]

Hi,

I have a Splunk query as below which does a comparison between this week's hosts and last week's hosts

index="summary" search_name="query_1" earliest=-1w@w latest=now
 | bucket span=1w _time 
 | stats values(_time) as weeks by my_hostname
| eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week") | search remark="Present this week but not last week" | stats count

Right now, I can only do the comparison between current week's hosts and last week's hosts

Now, how do I change the earliest and latest times in my query to compare the last week's hosts to before last week hosts and so on?

[skoelpin]

You can look into timewrap or use relative_time to accomplish this. If you choose the latter, what you'll need to do is remove that earliest and latest constraint on your top line, then create a new field for this week and capture the time for this week and create another field for last week and capture the timerange for that. Then you can expand the overall timerange for last week to now and run a timechart and split by both fields to do the comparison.

[pavanae]

@skoelpin. There is no timewrap app on our environment so my only other option is relative_time. Could you update the query by using the relative_time command for the earliest and latest times for last week and before last week.

[skoelpin]

What version of Splunk are you running? Should be a standard command on the later versions

index="summary" search_name="query_1" 
  | timechart span=1w count by my_hostname
  | timewrap 1d

Will update later with the query

[kamlesh_vaghela]

@pavanae,

If your earliest & latest from the eval then you can use sub search. like

index=main [ YOUR EVAL FOR earliest latest | table earliest latest | format "(" "(" "" ")" "OR" ")"  | table search ]

[skoelpin]

This will be an expensive search, always better to avoid subsearches when possible

[pavanae]

@kamlesh_vaghela. what could be my search if I my earliest is 2 weeks back and latest is 1 week back.

[kamlesh_vaghela]

@pavanae,

Your search would be like this.

index=main [ | makeresults | eval earliest=relative_time(now(),"-2w@w"), latest=relative_time(now(),"-1w@w")  | table earliest latest | format "(" "(" "" ")" "OR" ")"  | table search]

Try and let me know.

[renjith_nair]

@pavanae,

Did you try

earliest=-2w@w latest=-1w@w

[pavanae]

@renjith.nair. Yes I did. but I also need to change the time on my eval conditions which I'm not sure how to modify it?