Splunk Search

How to get results from last 1 week and last 3 week for the exact time frame of the search

achittela
Loves-to-Learn

I am new to Splunk, I am trying to get results in the below pattern. Any help is appreciated.

Lets say I am doing search for last 1 hour. I want to get only the results from last week and last 3 weeks and show the average of those.

For example I am doing search at 11 AM today for last 1 hour time frame. I want to get the results of  only 10 -11 AM every day of last 1 week and 10 - 11 AM of last 3 weeks. And show the average of those.

I tried earliest and latest time ranges also tried time chart with the search but not successful. 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's a run-anywhere example.

index=_internal kbps=* earliest=-3w 
`comment("Get the current hour and day-of-week")`
| eval hour=strftime(now(), "%H"), day=lower(strftime(now(), "%A")) 
`comment("Discard events that don't have the current hour and day")`
| where (date_hour=hour AND date_wday=day) 
| timechart cont=f avg(kbps)
---
If this reply helps you, Karma would be appreciated.
0 Karma

achittela
Loves-to-Learn

Thanks for replying me back. I tied with the below query, it didn't worked for me.

index=test_logs source_category=testapp* status=400 earliest=-3w
| eval hour=strftime(now(), "%H"), day=lower(strftime(now(), "%A"))
| where (date_hour=hour AND date_wday=day)
| timechart cont=f avg(source_category)

I want to show the statistics something like below.

source_category1weekAvg3weekAvg
testapp1109
testapp21512
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...