What is a query to get a comparison between last week's results and this week's results?

[pavanae]

Hi, I have a query as follows

index="summary" search_name="ABC" | dedup hostname | table hostname

Now I want see the hostnames which are in last week's result and not in this week's result and vice versa?

What are the earliest and latest times that I should be specified in subsearch and main search? What could be the query to get that result?

[woodcock]

Take a look at the timewrap command:

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Timewrap

If you are on an older version of Splunk, you may need to install this app:

https://splunkbase.splunk.com/app/1645/

[somesoni2 · Accepted solution]

Try like this (no subsearch). You can update the value of field remark per your need and then apply appropriate filter on the field remark to just keep the hostnames you're interested in.

index="summary" search_name="ABC" earliest=-1w@w latest=now
| bucket span=1w _time 
| stats values(_time) as weeks by hostname
| eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week"

[pavanae]

@somesoni2 . what could be my query if I wanted to do a comparison between before last week and last week's results instead of last week and now. What needed to be changed on remark, earliest and latest.

Comment here or answer below

https://answers.splunk.com/answers/696339/how-to-change-earliest-and-latest-times-on-my-quer.html