Splunk Search

How to display counts in the two weeks span for last two weeks and two weeks before

AshChakor
Path Finder

I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday

For example. 

_time

Count

2020-11-28

164

2020-12-05

488

2020-12-12

516

2020-12-26

5755

2021-01-02

482

2021-01-09

450

2021-01-16

1274

2021-01-23

33684

 

Expected Output is :

With two weeks time span I want to display the counts as below

 

Four weeks before  (164+488+516+5755)

Two weeks before  (450+482)

Latest two weeks    34958  ( which is count of 2021-01-16 and 2021-01-23  1274 + 33684)

 

Labels (3)
0 Karma

AshChakor
Path Finder

I found a solution but let me know if anyone has any better solution 

index="my index" | where <condition>
| timechart span=1w@w6 count as eachwcount
| eval latest_2weeks=relative_time(now(),"-1w@w6")
| eval two_weeks_before = relative_time(now(),"-3w@w6")
| eval four_weeks_before = relative_time(now(),"-5w@w6")
| eval weeksAgo=case(_time < two_weeks_before, "Four_Weeks_Before", _time >= two_weeks_before and _time < latest_2weeks," Two_Weeks_Before",_time >= latest_2weeks,"Latest_Two_Weeks")
| stats sum(eachwcount) as totalcount by weeksAgo

 

AshChakor_0-1611946587229.png

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...