Splunk Search

How do I combine search results from two different date time ranges into 1 table?

Path Finder

I am trying to combine results from two different time lines into a single table.

The search query for 1 day as follows:

some_app=my_app_name card_num=* | stats count(card_num) as "No: Requests" by card_num, plat

The result format as follows:

card_num plat No: Requests
XXX-1000 Windows  100
XXX-1002 mac      300
XXX-1002 linux    500  

I want to do the same search but over 7 days.

For example, I get following results for 7 days:

card_num plat No: Requests
XXX-1000 Windows 10056723
XXX-1002 mac     3007845623
XXX-7777 linux   67585647

I want to show it in a single table format as follows:

card_num plat No: Requests (1 day) Requests (7 day)
XXX-1000 Windows  100              10056723
XXX-1002 mac      300              3007845623
XXX-1002 linux    500              --
XXX-7777 linux    --               67585647

Is there a way I could make these searches once and create this table?

I do not have access to add plugins/ apps. Looking to do it without them. Thanks.

Tags (2)
0 Karma

Super Champion

have you tried the timewrap command?


otherwise, you could do some trickery with (feel free to experiment with ranges):

some_app=my_app_name card_num=* earliest=-7d|eval last7d=if(_time>relative_time(now(),"-7d"),1,0)|eval last24h=if(_time>relative_time(now(),"-24h"),1,0)| stats sum(last7d) as "No: Requests (last 7d)" sum(last24h) as  "No: Requests (last 24h)" by card_num, plat
0 Karma


This answer may be what you're looking for. It shows how to run 1 search and return results for different time periods


0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!