Splunk Search

How to display counts in the two weeks span for last two weeks and two weeks before

AshChakor
Path Finder

I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday

For example. 

_time

Count

2020-11-28

164

2020-12-05

488

2020-12-12

516

2020-12-26

5755

2021-01-02

482

2021-01-09

450

2021-01-16

1274

2021-01-23

33684

 

Expected Output is :

With two weeks time span I want to display the counts as below

 

Four weeks before  (164+488+516+5755)

Two weeks before  (450+482)

Latest two weeks    34958  ( which is count of 2021-01-16 and 2021-01-23  1274 + 33684)

 

Labels (3)
0 Karma

AshChakor
Path Finder

I found a solution but let me know if anyone has any better solution 

index="my index" | where <condition>
| timechart span=1w@w6 count as eachwcount
| eval latest_2weeks=relative_time(now(),"-1w@w6")
| eval two_weeks_before = relative_time(now(),"-3w@w6")
| eval four_weeks_before = relative_time(now(),"-5w@w6")
| eval weeksAgo=case(_time < two_weeks_before, "Four_Weeks_Before", _time >= two_weeks_before and _time < latest_2weeks," Two_Weeks_Before",_time >= latest_2weeks,"Latest_Two_Weeks")
| stats sum(eachwcount) as totalcount by weeksAgo

 

AshChakor_0-1611946587229.png

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!