Splunk Search

How to add a row with statistics for the last week?

qqzj
Explorer

Hey guys!

 

I need the statistics of a bunch of data by month. And this is done already.

 

search
|eval Month=strftime(_time,"%Y %m") | stats count(mydata) AS nobs, mean(mydata) as mean, min(mydata) as min by Month | reverse

 

The output is what I want:

Monthnobsmeanmin
2023 061900-5.0239778-68.73417
2023 053562-4.2430259-67.134697
2023 043181-4.1811658-64.995394
2023 034274-4.3373071-134.20177
2023 023939-4.7725011-73.538274
2023 012868-5.5231115-41.056093
2022 12395-4.617424-35.51642

 

Now I need add another row on the very top with statistics for the most recent WEEK. Ideally, I can use the search result without the need to search again and degrade performance. Thanks!

Labels (1)
0 Karma

qqzj
Explorer

Maybe last week is the wrong way to specify it. I should have written "the previous 7 days". Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...