Splunk Search
Highlighted

append comparison to 1 week earlier with timechart by

New Member

I have the following search which works nicely and shows me total sales over the past 24 hours compared to total sales the same day 1 week ago:

earliest=-1d@h latest=now eventtype=SALE | timechart span=15m count | eval sales="Past 24 Hours" | append [search earliest=-7d@h latest=-6d eventtype=SALE | timechart span=15m count | eval sales="Same Day Last Week" | eval _time =_time+86400*6] | timechart span=15m sum(count) AS count BY sales

I would like to do the same thing but timechart by a field (venue) so the result in a line chart would have 4 lines (assuming 2 venues). venue A, venue B, and total (venue a+b) (all for past 24 hours) and a fourth line with venue a+b the same time period a week ago.

The following search will show me the first three lines but I can not figure out how to include a fourth line showing the total from a week ago:

earliest=-1d@h latest=now eventtype=SALE AND venue="A" OR "B" | timechart span=15m count by venue | addtotals

Thanks in advance for your help

0 Karma
Highlighted

Re: append comparison to 1 week earlier with timechart by

Path Finder

This looks like it will give you what you want.

earliest=-7d@d latest=-6d@d eventtype=SALE AND venue="A" OR venue="B" | eval label="Total Same Day Last Week" | eval _time =_time+60*60*24*7 | append [search earliest=-0d@d eventtype=SALE AND venue="A" OR venue="B" | eval label="Total Today"] | append [search earliest=-0d@d eventtype=SALE AND venue="A" OR venue="B" | eval label=venue] | timechart span=15m count by label 
0 Karma
Highlighted

Re: append comparison to 1 week earlier with timechart by

New Member

Thanks for helping. This did not get me what I was looking for, but I was able to get it with appendcols:

earliest=-1d@h latest=now eventtype=SALE AND venue="A" OR "B" | timechart span=30m count | eval label="Total Today" | append [search earliest=-7d@h latest=-6d eventtype=SALE AND AND venue="A" OR "B" " | timechart span=30m count | eval label="Total Same Day Last Week" | eval time =time+86400*6] | timechart span=30m sum(count) AS count BY label | appendcols [search earliest=-1d@h latest=now eventtype=SALE AND AND venue="A" OR "B" | timechart span=30m count by venue]

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.