I just downloaded it successfully. This is not a bug with the app. This is not a bug with apps.splunk.com. It seems like you're just having internet trouble. I can go in a browser and get to: http://cdnjs.cloudflare.com/ajax/libs/underscore.js/1.4.4/underscore-min.js ... View more

1) If the settings are saved in props.conf, they are preserved after reboot. If must be the case that the regexes are not matching your data. Also, make sure that you actually save each rule created, if there are multiple rules created. 2) Sometimes the app is not able to create a rule that extracts a value you want and not one you don't want. In that case, you'll have to edit the rule (by clicking on 'edit' in the ui) ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. source="Perfmon:CPU Load" counter="% Processor Time" host="SERVER01" earliest=-1d@d latest=-0d@d | timechart avg(Value) span=1h | timewrap w | where strftime(_time, "%A") == "Thursday" That's it! http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap w That's it! If you want to limit it to a specific day of the week, add: ... | where strftime(_time, "%A") == "Saturday" http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap d That's it! http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap d That's it! http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap w That's it! You can then average whatever columns you want. http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap w That's it! If you want to limit it to a specific day of the week, add: ... | where strftime(_time, "%A") == "Wednesday" http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap w That's it! http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap w That's it! http://apps.splunk.com/app/1645/ ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap d That's it! http://apps.splunk.com/app/1645/ ... View more

I think this should do it: index=_internal earliest=-4w | timechart count span=1h | where strftime(_time, "%A") == strftime(now(),"%A") | timewrap w | rename "* ago" as * | addtotals "2w" "3w" "4w" | eval avg=Total/3.0 | table _time, _span, 1w, avg get events for last month generate timechart filter out results not from today's day-of-the-week (keeps only thursday data if today is thursday) timewrap all the days (e.g. thursdays) into the same day. rename fields for ease, calculate the total and the avg output just the columns needed to produce the chart ... View more

I see the confusion. Yes, "1w ago" really means "the most recent week". "2w ago" means "the 2nd most recent week". Think if it referring to the start of each time period. Perhaps if I just removed the word "ago", it might be less misleading. "1w", "2w", etc. The problem is that people might not be clear which is the more recent week. is the oldest "1w" and the next oldest "2w"? that's the exact opposite of what it means. bottomline: i'm open to suggestions! ... View more