How to create a search with week to week comparison of counts by SrcCountry

[will09222]

Hi,

I am new to splunk.

Currently using this query to get the count index=* SrcCountry=* | stats count by SrcCountry. 

If I wanted to narrow down the search to one country and get a week by week comparison of the count what kind of query could I use?

[sperkins]

index=* SrcCountry=Mexico 
| timechart span=1week count by SrcCountry 

This gives you a count by Country per week. 

Run the search across 2 weeks. (If you want complete weeks you can "snap down" to the nearest week by using span=1w@w)

Or, 
index=* SrcCountry=Mexico 
| timechart count by SrcCountry span=1d
| timewrap 1week

This returns a daily count by country, that is compared to the previous week days. 

I used Mexico as the example country. Any countries with spaces need quotes: like "United States"