Today date and previous day data

[uagraw01]

I want to calculate todays date data and previous day data from the host. Please suggest SPL for this.

[inventsekar]

hi @uagraw01 just curious - earliest and latest variables are ok or not ok?

[gcusello]

Hi @inventsekar,

I tried on my Splunk and correctly worked.

Ciao.

Giuseppe

[isoutamo]

At least in some older versions of splunk only official way was use all time as search period with metasearch. With other periods result was or wasn’t exactly correct. I’m not sure if this UFs still valid or not. Unfortunately I couldn’t find where I have gotten this information and could evaluate it now.

[gcusello]

Hi @uagraw01,

see if this example solves your need:

index=_internal
| eval day=if(date_year=strftime(now(),"%Y") AND date_month=lower(strftime(now(),"%B")) AND date_mday=strftime(now(),"%d"),"Today","Previous")
| stats count BY day

Ciao.

Giuseppe

[uagraw01]

@gcusello  I want the difference between pervious day count of the host and current day count of the host. I want comparison panel in my dashboard

[gcusello]

Hi @uagraw01,

as I said, I don't know in deep your need, but you can use my approach.

so using a search like mine you can display the count of events of today and previous day so you can compare the two numbers.

If you want more help, you should share more infos, e.g.:

• what's you main search
• which count you want to compare (e.g. numer of hosts).

so if you want to display the diference in numer of logging hosts between today and yesterday, you could run something like this:

index=_internal earliest=-d@d latest=now
| eval day=if(date_year=strftime(now(),"%Y") AND date_month=lower(strftime(now(),"%B")) AND date_mday=strftime(now(),"%d"),"Today","Previous")
| stats dc(host) AS hosts BY day
| delta hosts AS diff
| table diff

Ciao.

Giuseppe

Ciao.

Giuseppe

[uagraw01]

@gcusello  Can you suggest me another method. I mean another SPL. Because this search is very slow while executing. 

[gcusello · Accepted solution]

Hi @uagraw01,

if in yyour search you can use only the index time fields (index, sourcetyoe, source and host) you can use "|metasearch", having someting like this:

| metasearch index=_internal earliest=-d@d latest=now
| eval date_year=strftime(_time,"%Y"), date_month=strftime(_time,"%B"),date_mday=strftime(_time,"%d")
| eval now_date_year=strftime(now(),"%Y"), now_date_month=strftime(now(),"%B"),now_date_mday=strftime(now(),"%d")
| eval day=if(date_year=now_date_year AND date_month=now_date_month AND date_mday=now_date_mday,"Today","Previous")
| stats count BY day
| delta count AS diff
| reverse
| table diff
| head 1

Ciao.

 Giuseppe

[uagraw01]

@gcusello  It is working fine now . Thanks for yours extended help.

[gcusello]

Hi @uagraw01,

good for you, please accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

[uagraw01]

 Below is "no result" i am getting. I need todays day count, previous day count and the difference between todays count and previous day count. From the above query as you suggested not getting any results.

[gcusello]

Hi @uagraw01,

this is because you have only today's events!

enlarge your data frame and you'll have results.

Ciao.

Giuseppe