Splunk Search

event count comparison with today vs yesterday vs last week vs prior week


I have two strings like "opend" and "exited" in the events. So i need to count how many opened and exited today and that should be comparing today with yesterday vs last week vs prior week in the the form of line chart. legends should be like -Today-opened, -Today-exited,Yesterday-opened,Yesterday-exited and last week and prior week as well. Can you please help me.

Tags (1)
0 Karma

| multisearch 
     [ search index=****  "opend" earliest=-2w@w1 latest=-w@w1
     | eval what="prior week-opened"] 
     [search index=****  "exited" earliest=-2w@w1 latest=-w@w1
     | eval what="prior week-exited" ]
 [ search index=****  "opend" earliest=-w@w1 latest=@w1
     | eval what="prior week-opened"] 
     [search index=****  "exited" earliest=-w@w1 latest=@w1
     | eval what="last week-exited" ]
 [ search index=****  "opend" earliest=-1d@d latest=@d
     | eval what="last Yesterday-opened"] 
     [search index=****  "exited" earliest=-1d@d latest=@d
     | eval what="prior Yesterday-exited" ]
 [ search index=****  "opend" earliest=@d latest=+d@d
     | eval what="-Today-opened"] 
     [search index=****  "exited" earliest=@d latest=+d@d
     | eval what="-Today-exited" ]
 | chart count by date_hour what

check this.
0 Karma


Have you tried timewrap command?


comparing the count using line chart time span=h??

0 Karma

Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...