max values from two weeks using timechart

[secure]

Hello Everyone,

i have a dataset where I'm generating a column of number of servers per day.  using a timechart command for last 2 weeks.
earliest="-14d" latest=now() index=*...... | timechart span=1d dc(hostname) as servercount

My requirement is to split the data in previous week and latest week and get the maximum count from the previous week and the latest week 

[gcusello]

Hi @secure ,

did yu tried to use a different span period?

earliest="-14d" latest=now() index=*...... 
| timechart span=1w dc(hostname) AS servercount

Ciao.

Giuseppe

[PickleRick]

@gcuselloThat's something different. You're calculating weekly count of distict values whereas, as I understand, @secure wants to have maximum value of daily distinct count per week.

There are several possible approaches here.

One is to use the timechart output and use timewrap to transform the output into separate weekly data series. Since timewrap is a relatively straightforward command I'll leave the actual search to the reader 😉

Another way is to do manual binning

<@secure's search>
| bin _time span=1w as weekno
| stats max(servercount) by weekno