compare today statistic with to day from last week

[ahmedhassanean]

Dears,

i want to compare today statistic with the day from last week how can I do that

thank in advance

[MuS]

Hi ahmedhassanean,

try this run everywhere search as admin:

| tstats count WHERE earliest=-7d@d latest=now index=_internal by host, sourcetype, _time 
| bucket _time span=1d 
| stats last(_time) AS last_time sum(count) AS per_day_count by _time, host, sourcetype 
| eval last_week = if(last_time > exact(relative_time(now(),"-8d@d")) AND last_time <= exact(relative_time(now(),"-7d@d")) , per_day_count ,"0") 
| eval today = if(last_time > exact(relative_time(now(),"-1d@d")) AND last_time <= exact(relative_time(now(),"-0d@d")) , per_day_count ,"0") 
| stats sum(today) AS today sum(last_week) AS last_week by host

It will show you one way to do it by using stats and counting based on the time of the events. Another way can be using the timewrap command https://splunkbase.splunk.com/app/1645/ which should be available on Splunk cloud.

Hope this helps ...

cheers, MuS

[ahmedhassanean]

first many thanks for your support but i already have checked timewrap but what i want to compare for example SPL that end with below .SPL .... | timechart span=1h sum(stats) with same set of any day from last week

[MuS]

As I have written, it shows how it can be done. If the end result does not macho your needs, adapt the search.