Splunk Search

How to track the count of IP addresses on each server week over week for 4 weeks?

New Member

I need to see how many IP addresses are on each server for the current week, last week, 2 weeks ago, and 3 weeks ago. This needs to be tracked week over week and display a total of 4 weeks, like in the example below.

alt text

0 Karma

Revered Legend
0 Karma


Your search will look something like this

    index=foo sourcetype=bar earliest=-4w@w | eval wk=case(relative_time(_time, "-1w@w")<_time, "This Week", relative_time(_time, "-2w@w")<_time AND relative_time(_time, "-1w@w")>_time, "1 week",   and so on and so forth | chart count over server by wk
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!