Splunk Search

How to add a row with statistics for the last week?

qqzj
Explorer

Hey guys!

 

I need the statistics of a bunch of data by month. And this is done already.

 

search
|eval Month=strftime(_time,"%Y %m") | stats count(mydata) AS nobs, mean(mydata) as mean, min(mydata) as min by Month | reverse

 

The output is what I want:

Monthnobsmeanmin
2023 061900-5.0239778-68.73417
2023 053562-4.2430259-67.134697
2023 043181-4.1811658-64.995394
2023 034274-4.3373071-134.20177
2023 023939-4.7725011-73.538274
2023 012868-5.5231115-41.056093
2022 12395-4.617424-35.51642

 

Now I need add another row on the very top with statistics for the most recent WEEK. Ideally, I can use the search result without the need to search again and degrade performance. Thanks!

Labels (1)
0 Karma

qqzj
Explorer

Maybe last week is the wrong way to specify it. I should have written "the previous 7 days". Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...