Splunk Search

Timechart query for Splunk Visualization 42

smthakur73
New Member

Need help with the following code:
index=corp_security_tanium splunk_server=phx11* sourcetype=ABC
| eval time=strptime(Last_Found_Date,"%Y-%m-%d")
| eval _time=time
| bucket span=w@w1 _time
| stats values(ABC) by ABC _time
| timechart span=w@w1 count(ABC) as "Accumulated count"

Time filter : Last 7 days
basically it should show the current no. and what the difference between last week and today

Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...