I have a Splunk query as below which does a comparison between this week's hosts and last week's hosts
index="summary" search_name="query_1" earliest=-1w@w latest=now | bucket span=1w _time | stats values(_time) as weeks by my_hostname | eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week") | search remark="Present this week but not last week" | stats count
Right now, I can only do the comparison between current week's hosts and last week's hosts
Now, how do I change the earliest and latest times in my query to compare the last week's hosts to before last week hosts and so on?
You can look into
timewrap or use
relative_time to accomplish this. If you choose the latter, what you'll need to do is remove that earliest and latest constraint on your top line, then create a new field for this week and capture the time for this week and create another field for last week and capture the timerange for that. Then you can expand the overall timerange for last week to now and run a timechart and split by both fields to do the comparison.
@skoelpin. There is no timewrap app on our environment so my only other option is relative_time. Could you update the query by using the relative_time command for the earliest and latest times for last week and before last week.
What version of Splunk are you running? Should be a standard command on the later versions
index="summary" search_name="query_1" | timechart span=1w count by my_hostname | timewrap 1d
Will update later with the query
If your earliest & latest from the eval then you can use sub search. like
index=main [ YOUR EVAL FOR earliest latest | table earliest latest | format "(" "(" "" ")" "OR" ")" | table search ]
Your search would be like this.
index=main [ | makeresults | eval earliest=relative_time(now(),"-2w@w"), latest=relative_time(now(),"-1w@w") | table earliest latest | format "(" "(" "" ")" "OR" ")" | table search]
Try and let me know.