How to search the total count for today and the same day last week?

[aparnaa]

Hi Experts

Good Day

Below is my search:

index="web_summary_index" source="resp_time_ss"|   eval 7daybackdate=strftime(relative_time(now(), "-7d@d" ),"%Y-%m-%d") |eval date=strftime(_time,"%d-%m-%Y") | stats dc(cs_uri_stem) as Total by date

I get the output in below format

date count
2016-11-01 5
...
..
.
2016-11-10 50
2016-11-11 75
2016-11-12 100

My requirement:
I want to get just today's date and last week's same day count only, and also create a chart for the same.
I want to add it in the dashboard for my Manager's view, but I am not really sure how to use timechart for this.

Can you please help?

Thanks,
aparna

[niketn]

Please refer to following Splunk blog on the same which tells on how to use append/appendcols to correlate today's data with last week same day over a timechart and overlay the results:
http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/

If you want to compare time series data over an older timerange you can also look at timewrap functionality in Splunk 6.5. Prior to that there was Splunk Timewrap App for the same

For example:

timechart count | timewrap 1week

Refer to Splunk documentation if you are 6.5 : http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap#Timescale_options

For previous versions check out Splunk Timewrap App: https://splunkbase.splunk.com/app/1645/

[gokadroid]

For the distinct counts of whole day today (till now) and the same day last week you can try this query:

index="web_summary_index" source="resp_time_ss" earliest=@d
| stats dc(cs_uri_stem) as Total 
| eval ReportKey="Today" 
append [search index="web_summary_index" source="resp_time_ss" earliest=-7d@d latest=-6d@d
| stats dc(cs_uri_stem) as Total
| eval ReportKey="LastWeek" ]
| chart Total by ReportKey

[john_q]

Hi gokadroid,

I have the similar question that is i want to create an alert for specific day count compare with the same day in last week and prior week and make sure that count should be match with 20%(-/+).
my query is like index=something source=something "error" | stats count