Hi Experts
Good Day
Below is my search:
index="web_summary_index" source="resp_time_ss"| eval 7daybackdate=strftime(relative_time(now(), "-7d@d" ),"%Y-%m-%d") |eval date=strftime(_time,"%d-%m-%Y") | stats dc(cs_uri_stem) as Total by date
I get the output in below format
date count
2016-11-01 5
...
..
.
2016-11-10 50
2016-11-11 75
2016-11-12 100
My requirement:
I want to get just today's date and last week's same day count only, and also create a chart for the same.
I want to add it in the dashboard for my Manager's view, but I am not really sure how to use timechart for this.
Can you please help?
Thanks,
aparna
Please refer to following Splunk blog on the same which tells on how to use append/appendcols to correlate today's data with last week same day over a timechart and overlay the results:
http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/
If you want to compare time series data over an older timerange you can also look at timewrap functionality in Splunk 6.5. Prior to that there was Splunk Timewrap App for the same
For example:
timechart count | timewrap 1week
Refer to Splunk documentation if you are 6.5 : http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap#Timescale_options
For previous versions check out Splunk Timewrap App: https://splunkbase.splunk.com/app/1645/
For the distinct counts of whole day today (till now) and the same day last week you can try this query:
index="web_summary_index" source="resp_time_ss" earliest=@d
| stats dc(cs_uri_stem) as Total
| eval ReportKey="Today"
append [search index="web_summary_index" source="resp_time_ss" earliest=-7d@d latest=-6d@d
| stats dc(cs_uri_stem) as Total
| eval ReportKey="LastWeek" ]
| chart Total by ReportKey
Hi gokadroid,
I have the similar question that is i want to create an alert for specific day count compare with the same day in last week and prior week and make sure that count should be match with 20%(-/+).
my query is like index=something source=something "error" | stats count