Splunk Search

How to run a same search with multiple time ranges and append the value compare them?

manojntr
Observer

Here is the example of the search looks like :

index=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/09/2022:00:00:00 latest=05/09/2022:24:00:00 )| rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 | appendcols [ searchindex=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/16/2022:00:00:00 latest=05/16/2022:24:00:00 ) || rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 ]

Ideally i want to run the search for 9th and 16 of this monday and get the count of each day and compare , I'm not able to divide the count for each day 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Both top commands are creating fields with the same names (count and percent) - rename these after the first top

index=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/09/2022:00:00:00 latest=05/09/2022:24:00:00 )| rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 
| rename count as count09 percent as percent09
| appendcols [ searchindex=x* OR index=y* OR index=z* Iabcd 12_* ( earliest=05/16/2022:00:00:00 latest=05/16/2022:24:00:00 ) || rex field=_raw "timerField:\d+:\d+:\d+:\d+ (?<xyzApi>\w+)" | fields +xyzApi test_filed_1test_filed_1 index
 | top xyzApi test_filed_1test_filed_1 index limit=20 ]
0 Karma

manojntr
Observer

@ITWhisperer When i renamed the count and percent they are showing up as empty columns 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the search you are using for this result?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you look timewrap -command? I think that this can solve your issue. There are quite many answers about this which you could easily found by google.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...