Splunk Search

superimposed timeline chart comparing the latest and last week data

prajwal_94
Explorer

For the below query, searching for the values of 2nd occurence of earliest and latest events so that the timechart would return superimposed data from current time minus 2hrs and last week data for same time frame(2hrs).

index=sample sourcetype=hello "*abc*" earliest=-120m@m latest=now | multikv | eval ReportKey="today" | append [ search index=sample sourcetype=hello "*abc*" earliest=... latest=... | multikv | eval ReportKey="lastweek" | eval _time=_time+86400] | timechart span=5m count by ReportKey usenull=false useother=false

 

Thanks in advance!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Timechart seems to try to be clever and determine the earliest searched time, despite any manipulation done to the _time field, so use bin and chart instead. However, bear in mind that the chart will start from the earliest event time (adjusted) and not necessarily from the earliest time searched.

index=_internal earliest=-2h@m latest=@m
| eval ReportKey="Today"
| append
    [search index=_internal earliest=-2h-7d@m latest=-7d@m
    | eval ReportKey="Last week"
    | eval _time=relative_time(_time,"+7d")]
| bin span=5m _time
| chart count by _time ReportKey

 

View solution in original post

prajwal_94
Explorer

Thank you so much @ITWhisperer , it worked!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Timechart seems to try to be clever and determine the earliest searched time, despite any manipulation done to the _time field, so use bin and chart instead. However, bear in mind that the chart will start from the earliest event time (adjusted) and not necessarily from the earliest time searched.

index=_internal earliest=-2h@m latest=@m
| eval ReportKey="Today"
| append
    [search index=_internal earliest=-2h-7d@m latest=-7d@m
    | eval ReportKey="Last week"
    | eval _time=relative_time(_time,"+7d")]
| bin span=5m _time
| chart count by _time ReportKey

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...