I have a Splunk query as below which does a comparison between this week's hosts and last week's hosts
index="summary" search_name="query_1" earliest=-1w@w latest=now | bucket span=1w _time | stats values(_time) as weeks by my_hostname | eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week") | search remark="Present this week but not last week" | stats count
Right now, I can only do the comparison between current week's hosts and last week's hosts
Now, how do I change the earliest and latest times in my query to compare the last week's hosts to before last week hosts and so on?
@renjith.nair. Yes I did. but I also need to change the time on my eval conditions which I'm not sure how to modify it?
If your earliest & latest from the eval then you can use sub search. like
index=main [ YOUR EVAL FOR earliest latest | table earliest latest | format "(" "(" "" ")" "OR" ")" | table search ]
@kamlesh_vaghela. what could be my search if I my earliest is 2 weeks back and latest is 1 week back.
Your search would be like this.
index=main [ | makeresults | eval earliest=relative_time(now(),"-2w@w"), latest=relative_time(now(),"-1w@w") | table earliest latest | format "(" "(" "" ")" "OR" ")" | table search]
Try and let me know.
This will be an expensive search, always better to avoid subsearches when possible
You can look into
timewrap or use
relative_time to accomplish this. If you choose the latter, what you'll need to do is remove that earliest and latest constraint on your top line, then create a new field for this week and capture the time for this week and create another field for last week and capture the timerange for that. Then you can expand the overall timerange for last week to now and run a timechart and split by both fields to do the comparison.
@skoelpin. There is no timewrap app on our environment so my only other option is relativetime. Could you update the query by using the relativetime command for the earliest and latest times for last week and before last week.
What version of Splunk are you running? Should be a standard command on the later versions
index="summary" search_name="query_1" | timechart span=1w count by my_hostname | timewrap 1d
Will update later with the query