Splunk Search

Single Value Trend Interval: How to compare values from "start of the day to current time" with the same time period yesterday (-1d@d)?

nabeel652
Builder

In a single value trend interval, I am trying to compare number of certs issued "from start of the day to current time" to "start of the day to same time yesterday". Currently, it compares with yesterday, and in the morning when were certs issued for today, there are very few and it doesn't make any sense.

0 Karma

sundareshr
Legend

Try this.

sourcetype=WinEventLog:Security (EventCode=4886 OR EventCode=4887 OR EventCode=4888 ) earliest=-1d@d | transaction RequestID | fields _time Msg | where like(Msg,\"%received a certificate request%\")  | where strftime(now(), "%H")>strftime(_time, "%H") | bin span=1d _time | stats count AS Requests by _time
0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

I use this method to compare

index=_internal metrics main earliest=-2d@d latest=@d 
| eval yesterday_count=if(_time>relative_time(now(),"-2d@d") AND _time<relative_time(now(),"-1d@d"), 1, 0) 
| eval today_count=if(_time>relative_time(now(),"-1d@d") AND _time<relative_time(now(),"@d"), 1, 0) 
| stats sum(yesterday_count) as yesterday_total sum(today_count) as today_total
0 Karma

nabeel652
Builder

Thanks. But I want to fit this with the Single Value trend interval. How it compares is with date/time modifiers earliest and latest in the element setting trendInterval.

Like it says: 44 certs today down by 68 as it compares certs issued today with total certs issued yesterday.

0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

If you don't mind, if you could post a sample of the data, and the query you are using, and the actual output, and the desired output, then I could help you more.

0 Karma

nabeel652
Builder

Well the search I am using is:

sourcetype=WinEventLog:Security (EventCode=4886 OR EventCode=4887 OR EventCode=4888 ) | transaction RequestID | table _time,Msg | where like(Msg,\"%received a certificate request%\") | eval date = tostring(strftime(_time,\"%Y%m%d%H%M\")) | eval _time=strptime(date, \"%Y%m%d%H%M\") | timechart count(Msg) AS Requests span=24h"

And single value element settings are:

var element1 = new SingleElement({
"id": "element1",
"showSparkline": "1",
"numberPrecision": "0",
"rangeValues": "[0]",
"underLabel": "compared to previous 24 hours",
"trendInterval": "-24h",
"trendDisplayMode": "absolute",
"colorBy": "value",
"drilldown": "all",
"linkView": "search",
"colorMode": "block",
"useColors": "1",
"showTrendIndicator": "1",
"rangeColors": "[\"0xFF0000\",\"0x008000\"]",
"height": "160",
"unitPosition": "after",
"useThousandSeparators": "1",
"trendColorInterpretation": "standard",
"managerid": "search1",
"el": $('#element1')
}, {tokens: true, tokenNamespace: "submitted"}).render();

this compares certs issued today (up to current time) with certs issued yesterday the whole day.
I just need is to compare with the interval mid-night yesterday to current time with mid-night the previous day to same yesterday.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...