Splunk Search
Highlighted

How to edit my search to display the current count and the count from 5 minutes ago in one line?

Engager

Hi

Now I need to show the current count and the count five minutes ago in one row. The current count search is:

 index=app   host="xxxx"   sourcetype=xxx    status>399   route =*   earliest=-15m@m latest=@m| bucket span=5m _time
 | stats count as current_count by _time route

And the respected result is like this:
alt text
How can I do it?

0 Karma
Highlighted

Re: How to edit my search to display the current count and the count from 5 minutes ago in one line?

SplunkTrust
SplunkTrust

Try this

index=app host="xxxx" sourcetype=xxx status>399 route =* earliest=-15m@m latest=@m| bucket span=5m _time
| stats count as current_count by _time route | streamstats current=f window=1 values(current_count) as previous_count  by route
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.