Splunk Search

How do I change earliest and latest times on the relative_time to compare the historic results instead of the current?

Builder

Hi,

I have a Splunk query as below which does a comparison between this week's hosts and last week's hosts

index="summary" search_name="query_1" earliest=-1w@w latest=now
 | bucket span=1w _time 
 | stats values(_time) as weeks by my_hostname
| eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week") | search remark="Present this week but not last week" | stats count

Right now, I can only do the comparison between current week's hosts and last week's hosts

Now, how do I change the earliest and latest times in my query to compare the last week's hosts to before last week hosts and so on?

0 Karma

SplunkTrust
SplunkTrust

You can look into timewrap or use relative_time to accomplish this. If you choose the latter, what you'll need to do is remove that earliest and latest constraint on your top line, then create a new field for this week and capture the time for this week and create another field for last week and capture the timerange for that. Then you can expand the overall timerange for last week to now and run a timechart and split by both fields to do the comparison.

0 Karma

Builder

@skoelpin. There is no timewrap app on our environment so my only other option is relative_time. Could you update the query by using the relative_time command for the earliest and latest times for last week and before last week.

0 Karma

SplunkTrust
SplunkTrust

What version of Splunk are you running? Should be a standard command on the later versions

index="summary" search_name="query_1" 
  | timechart span=1w count by my_hostname
  | timewrap 1d

Will update later with the query

0 Karma

SplunkTrust
SplunkTrust

@pavanae,

If your earliest & latest from the eval then you can use sub search. like

index=main [ YOUR EVAL FOR earliest latest | table earliest latest | format "(" "(" "" ")" "OR" ")"  | table search ]
0 Karma

SplunkTrust
SplunkTrust

This will be an expensive search, always better to avoid subsearches when possible

0 Karma

Builder

@kamlesh_vaghela. what could be my search if I my earliest is 2 weeks back and latest is 1 week back.

0 Karma

SplunkTrust
SplunkTrust

@pavanae,

Your search would be like this.

index=main [ | makeresults | eval earliest=relative_time(now(),"-2w@w"), latest=relative_time(now(),"-1w@w")  | table earliest latest | format "(" "(" "" ")" "OR" ")"  | table search]

Try and let me know.

0 Karma

SplunkTrust
SplunkTrust

@pavanae,

Did you try

earliest=-2w@w latest=-1w@w
0 Karma

Builder

@renjith.nair. Yes I did. but I also need to change the time on my eval conditions which I'm not sure how to modify it?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!