I want to compare the results from one Saturday to 3-4 prior Saturdays. The query I am using is created from the postings here and returns the # of events/second that were logged for a particular host.
host="Prod_LogHistory"| eval count=1 | timechart per_second(count) as events_per_second
I would like to see a line chart that could show 3-4 Saturday's on the same chart.
Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.
I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.
... | timechart count span=1h | timewrap w
That's it!
If you want to limit it to a specific day of the week, add:
... | where strftime(_time, "%A") == "Saturday"
Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.
I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.
... | timechart count span=1h | timewrap w
That's it!
If you want to limit it to a specific day of the week, add:
... | where strftime(_time, "%A") == "Saturday"
host="Prod_LogHistory" date_wday=saturday earliest=-4w@w6 | eval count=1 | timechart span=24h per_second(count) as events_per_second
This works to just give me the two days, but there is a large gap in the graph. Is there a way to see the prior weekday on the same graph at a same week day.
Is "| eval count=1" leftover text from a test?
You could probably do it like this:
host="Prod_LogHistory" earliest=-1mon@w6 | timechart span=1w per_second(count) as events_per_second
That should snap the date back 1 month, round it to Saturday, then show a timechart with 1 week intervals from Saturday.