I am new to Splunk, I am trying to get results in the below pattern. Any help is appreciated.
Lets say I am doing search for last 1 hour. I want to get only the results from last week and last 3 weeks and show the average of those.
For example I am doing search at 11 AM today for last 1 hour time frame. I want to get the results of only 10 -11 AM every day of last 1 week and 10 - 11 AM of last 3 weeks. And show the average of those.
I tried earliest and latest time ranges also tried time chart with the search but not successful.
Here's a run-anywhere example.
index=_internal kbps=* earliest=-3w
`comment("Get the current hour and day-of-week")`
| eval hour=strftime(now(), "%H"), day=lower(strftime(now(), "%A"))
`comment("Discard events that don't have the current hour and day")`
| where (date_hour=hour AND date_wday=day)
| timechart cont=f avg(kbps)
Thanks for replying me back. I tied with the below query, it didn't worked for me.
index=test_logs source_category=testapp* status=400 earliest=-3w
| eval hour=strftime(now(), "%H"), day=lower(strftime(now(), "%A"))
| where (date_hour=hour AND date_wday=day)
| timechart cont=f avg(source_category)
I want to show the statistics something like below.
source_category | 1weekAvg | 3weekAvg |
testapp1 | 10 | 9 |
testapp2 | 15 | 12 |