Splunk Search

How to display counts in the two weeks span for last two weeks and two weeks before

AshChakor
Path Finder

I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday

For example. 

_time

Count

2020-11-28

164

2020-12-05

488

2020-12-12

516

2020-12-26

5755

2021-01-02

482

2021-01-09

450

2021-01-16

1274

2021-01-23

33684

 

Expected Output is :

With two weeks time span I want to display the counts as below

 

Four weeks before  (164+488+516+5755)

Two weeks before  (450+482)

Latest two weeks    34958  ( which is count of 2021-01-16 and 2021-01-23  1274 + 33684)

 

Labels (3)
0 Karma

AshChakor
Path Finder

I found a solution but let me know if anyone has any better solution 

index="my index" | where <condition>
| timechart span=1w@w6 count as eachwcount
| eval latest_2weeks=relative_time(now(),"-1w@w6")
| eval two_weeks_before = relative_time(now(),"-3w@w6")
| eval four_weeks_before = relative_time(now(),"-5w@w6")
| eval weeksAgo=case(_time < two_weeks_before, "Four_Weeks_Before", _time >= two_weeks_before and _time < latest_2weeks," Two_Weeks_Before",_time >= latest_2weeks,"Latest_Two_Weeks")
| stats sum(eachwcount) as totalcount by weeksAgo

 

AshChakor_0-1611946587229.png

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...