Hello ,
I want to show trending compared to last score calculated.
I have multiple single panels calculating one field "score"for last month(August) based on some condition like last_month_count(August count) > last2_month (july count)
and taking summation of all panel's result value in another dashboard Panel as total_score
Now, I want to show trending compared to last total_ score to this month total_score.
Please suggest ,how to approach for the same.
Thanks.
Hi @avni26,
As Rich suggested you can do this using timewrap
whoever if that doesn't work for you then you can use append
instead to build your search as shown in the first answer here :
https://answers.splunk.com/answers/371015/display-comparison-between-last-week-vs-this-week.html
Let me know what your search looks like if the above link didn't work for you so we can try and fix it.
Cheers,
David
@DavidHourani , yes append only do. But my query is already too long and also have several panel's each having their independent index . By append ,I have to write all query again for last month. 😞
I guess, i have to use report for the same.
How about using an eval
to create a field containing "Current Month" and "last Month" based on the time and then run a timechart by
that field ?
@DavidHourani yes, this can be perfect. Please share any sample query for more understanding. If possible.
Have you looked at the timewrap
command?
yes, timewrap will not work in my query , as for each panel , i am just searching for last month.
Any other way?