Hi,
is it possible to search a field value and then count it for example first today and then add the count of the same from the week before ?
I checked this example: https://community.splunk.com/t5/Splunk-Search/search-a-value-in-previous-time-period-and-add-to-curr...
and did a query like this
index=my_summary source="my_source" earliest=-1w@w
| bucket span=1w _time
| where Total_Requests > 10 AND Total_New_Services > 15
| stats values(info_min_time) as earliest values(info_max_time) as latest values(user) as user, values(Total_Requests) as Total_Requests, values(Service_Name) as Service_Name, values(Total_New_Services) as Total_New_Services by Account_Name _time
| convert ctime(earliest) ctime(latest)
| eventstats sum(Total_Requests) as Total_Requests_last7days sum(Total_New_Services) as Total_New_Services_last7days by Account_Name
only issue I see with my query is the _time values are different and the earliest & latest time values are different (its a summary index btw) but the Total_Requests, Total_Requests_last7days, Total_New_Services, Total_New_Services_last7days are as expected
Any help would be appreciated, thank you!
