How to compare current week to last week in a visualisation?

[supersnedz]

Hello, im looking to compare a count of servers that was reporting into splunk this week and compare to the amount that reported the week before. Im using the Dashboard studio for my visualisations. 

My current query shows how many servers reported per day over the week: an represents the server name.

index="siem-ips" cim_entity_zone="global" | timechart dc(an)

How can i modify this to show what the previous week looked like over the current week? 

Thank you 🙂

[rut · Accepted solution]

Are you sure you're retrieving enough data (so the earliest is set correctly)?

You can play around with timewrap with the following example.  Try setting count to 8 (which matches your screenshot) and 21 (which compares three weeks):

| makeresults count=14
``` Set up the data, count the days and subtract them from _time ```
| streamstats count
| eval _time=relative_time(_time, "-".(count -1)."d")
``` Chart the data by day ```
| timechart sum(count) span=1d
``` Compare it by week ```
| timewrap 1w

[supersnedz]

Ah yes, I was being silly and had the time frame set to 7 days rather than 14! Thank you for the help i really appreciate it! 

[rut]

Hi @supersnedz, you can follow up timechart with the timewrap command:

| timewrap 1w

You can read more about timewrap over here:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap

[supersnedz]

Hi @rut 

I tried the following:
index="siem-eu" cim_entity_zone="global" | timechart span=1d dc(an) | timewrap 1w

It returned only one day from the previous week rather than the whole week. 

is there a way i can do this for each day of the week?