Splunk Search

How to display counts in the two weeks span for last two weeks and two weeks before

AshChakor
Path Finder

I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday

For example. 

_time

Count

2020-11-28

164

2020-12-05

488

2020-12-12

516

2020-12-26

5755

2021-01-02

482

2021-01-09

450

2021-01-16

1274

2021-01-23

33684

 

Expected Output is :

With two weeks time span I want to display the counts as below

 

Four weeks before  (164+488+516+5755)

Two weeks before  (450+482)

Latest two weeks    34958  ( which is count of 2021-01-16 and 2021-01-23  1274 + 33684)

 

Labels (3)
0 Karma

AshChakor
Path Finder

I found a solution but let me know if anyone has any better solution 

index="my index" | where <condition>
| timechart span=1w@w6 count as eachwcount
| eval latest_2weeks=relative_time(now(),"-1w@w6")
| eval two_weeks_before = relative_time(now(),"-3w@w6")
| eval four_weeks_before = relative_time(now(),"-5w@w6")
| eval weeksAgo=case(_time < two_weeks_before, "Four_Weeks_Before", _time >= two_weeks_before and _time < latest_2weeks," Two_Weeks_Before",_time >= latest_2weeks,"Latest_Two_Weeks")
| stats sum(eachwcount) as totalcount by weeksAgo

 

AshChakor_0-1611946587229.png

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting V2

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...