Splunk Search

How to run a same search with multiple time ranges and append the value compare them?

manojntr
Observer

Here is the example of the search looks like :

index=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/09/2022:00:00:00 latest=05/09/2022:24:00:00 )| rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 | appendcols [ searchindex=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/16/2022:00:00:00 latest=05/16/2022:24:00:00 ) || rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 ]

Ideally i want to run the search for 9th and 16 of this monday and get the count of each day and compare , I'm not able to divide the count for each day 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Both top commands are creating fields with the same names (count and percent) - rename these after the first top

index=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/09/2022:00:00:00 latest=05/09/2022:24:00:00 )| rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 
| rename count as count09 percent as percent09
| appendcols [ searchindex=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/16/2022:00:00:00 latest=05/16/2022:24:00:00 ) || rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 ]
0 Karma

manojntr
Observer

@ITWhisperer When i renamed the count and percent they are showing up as empty columns 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the search you are using for this result?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you look timewrap -command? I think that this can solve your issue. There are quite many answers about this which you could easily found by google.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...