Hi,
My requirement is to take each week monday data alone for a month in trending chart .
This need to be showed for status field ,which will have ( pass,fail,error,deleted) values in it.The individual count of status to be shown for each week monday for a month.
Please let me know how to do this .
Hi @dtccsundar,
date_wday is a default field in Splunk, if you haven't you can extract it in this way from _time:
<your_search>
| eval date_wday=strftime(_time,"%A")
| search date_wday!="Monday"
Ciao.
Giuseppe
Thank you .
Yes tried with earliest=-30d@w1 latest=-d@w1 in my search , but i couldnt get the desired o/p.
I am not seeing the field date_wday in my events , since i am using a sql view as source.How this can be achieved in this case.
Hi @dtccsundar,
please try something like this:
earliest=-30d@d latest=-d@d date_wday="monday"
Ciao.
Giuseppe
Thank you .
I am getting no results for this .
I have _time field in my events . Is is possible to derive each monday from that ?
Hi @dtccsundar,
date_wday is a default field in Splunk, if you haven't you can extract it in this way from _time:
<your_search>
| eval date_wday=strftime(_time,"%A")
| search date_wday!="Monday"
Ciao.
Giuseppe
Thank you. This worked Perfectly !!
Hi @dtccsundar,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉
Hi Giuseppe,
Can you please help me in the below drill down please ,
Need help for the below, The sourcetypes has different values in it like below,
index=a sourcetype=b |eval details= ONE |
append [|search index=c sourcetype=d|eval details=TWO] |
append [|search index=e sourcetype=f|eval details=THREE]
|eventstats count by details| Pass%=count(pass)/total*100,2 Fail%=count(fail)/total*100,2 Error%=count(Error)/total*100,2 |table pass fail error total
I have a barchart with x-axis with details and y-axis %(pass%,fail%,error%) of ( pass fail error etc).
When i click the details(x-axis) in barchart , the trending should show number of individual Pass,fail,error based on the details values selected .
The click values should be passed to the the trending .Please let me know how it can be achieved .