Splunk Search

append comparison to 1 week earlier with timechart by

bwscot
New Member

I have the following search which works nicely and shows me total sales over the past 24 hours compared to total sales the same day 1 week ago:

earliest=-1d@h latest=now eventtype=SALE | timechart span=15m count | eval sales="Past 24 Hours" | append [search earliest=-7d@h latest=-6d eventtype=SALE | timechart span=15m count | eval sales="Same Day Last Week" | eval _time =_time+86400*6] | timechart span=15m sum(count) AS count BY sales

I would like to do the same thing but timechart by a field (venue) so the result in a line chart would have 4 lines (assuming 2 venues). venue A, venue B, and total (venue a+b) (all for past 24 hours) and a fourth line with venue a+b the same time period a week ago.

The following search will show me the first three lines but I can not figure out how to include a fourth line showing the total from a week ago:

earliest=-1d@h latest=now eventtype=SALE AND venue="A" OR "B" | timechart span=15m count by venue | addtotals

Thanks in advance for your help

0 Karma

eelisio2
Path Finder

This looks like it will give you what you want.

earliest=-7d@d latest=-6d@d eventtype=SALE AND venue="A" OR venue="B" | eval label="Total Same Day Last Week" | eval _time =_time+60*60*24*7 | append [search earliest=-0d@d eventtype=SALE AND venue="A" OR venue="B" | eval label="Total Today"] | append [search earliest=-0d@d eventtype=SALE AND venue="A" OR venue="B" | eval label=venue] | timechart span=15m count by label 
0 Karma

bwscot
New Member

Thanks for helping. This did not get me what I was looking for, but I was able to get it with appendcols:

earliest=-1d@h latest=now eventtype=SALE AND venue="A" OR "B" | timechart span=30m count | eval label="Total Today" | append [search earliest=-7d@h latest=-6d eventtype=SALE AND AND venue="A" OR "B" " | timechart span=30m count | eval label="Total Same Day Last Week" | eval _time =_time+86400*6] | timechart span=30m sum(count) AS count BY label | appendcols [search earliest=-1d@h latest=now eventtype=SALE AND AND venue="A" OR "B" | timechart span=30m count by venue]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...