Splunk Search

compare today statistic with to day from last week

ahmedhassanean
Explorer

Dears,

i want to compare today statistic with the day from last week how can I do that

thank in advance

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ahmedhassanean,

try this run everywhere search as admin:

| tstats count WHERE earliest=-7d@d latest=now index=_internal by host, sourcetype, _time 
| bucket _time span=1d 
| stats last(_time) AS last_time sum(count) AS per_day_count by _time, host, sourcetype 
| eval last_week = if(last_time > exact(relative_time(now(),"-8d@d")) AND last_time <= exact(relative_time(now(),"-7d@d")) , per_day_count ,"0") 
| eval today = if(last_time > exact(relative_time(now(),"-1d@d")) AND last_time <= exact(relative_time(now(),"-0d@d")) , per_day_count ,"0") 
| stats sum(today) AS today sum(last_week) AS last_week by host

It will show you one way to do it by using stats and counting based on the time of the events. Another way can be using the timewrap command https://splunkbase.splunk.com/app/1645/ which should be available on Splunk cloud.

Hope this helps ...

cheers, MuS

0 Karma

ahmedhassanean
Explorer

first many thanks for your support but i already have checked timewrap but what i want to compare for example SPL that end with below .SPL .... | timechart span=1h sum(stats) with same set of any day from last week

0 Karma

MuS
SplunkTrust
SplunkTrust

As I have written, it shows how it can be done. If the end result does not macho your needs, adapt the search.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...