Splunk Search

How to get results from last 1 week and last 3 week for the exact time frame of the search

achittela
Loves-to-Learn

I am new to Splunk, I am trying to get results in the below pattern. Any help is appreciated.

Lets say I am doing search for last 1 hour. I want to get only the results from last week and last 3 weeks and show the average of those.

For example I am doing search at 11 AM today for last 1 hour time frame. I want to get the results of  only 10 -11 AM every day of last 1 week and 10 - 11 AM of last 3 weeks. And show the average of those.

I tried earliest and latest time ranges also tried time chart with the search but not successful. 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's a run-anywhere example.

index=_internal kbps=* earliest=-3w 
`comment("Get the current hour and day-of-week")`
| eval hour=strftime(now(), "%H"), day=lower(strftime(now(), "%A")) 
`comment("Discard events that don't have the current hour and day")`
| where (date_hour=hour AND date_wday=day) 
| timechart cont=f avg(kbps)
---
If this reply helps you, Karma would be appreciated.
0 Karma

achittela
Loves-to-Learn

Thanks for replying me back. I tied with the below query, it didn't worked for me.

index=test_logs source_category=testapp* status=400 earliest=-3w
| eval hour=strftime(now(), "%H"), day=lower(strftime(now(), "%A"))
| where (date_hour=hour AND date_wday=day)
| timechart cont=f avg(source_category)

I want to show the statistics something like below.

source_category1weekAvg3weekAvg
testapp1109
testapp21512
0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...