comparing the count using line chart time span=h?? ... View more

its working fine but x axis field names are not displaying like by cause. stats count(type) as names sum(bytes) as Bytes by browsers | addtotals fieldname=_Total | foreach * [eval <> = '<>' * 100 / _Total] | fields - _Total ... View more

Hi @devinbrady , yes its working as what i need exactly but x axis names are not displaying. example view_version names in your case. ... View more

Hi @mayurr98 , thanks for the reference but i don't want to use the script. i am looking for a query which shows percentage. for example request_time count is 622 and app_error count is 350 then when i mouse over on the bar display request_time 62.2% and app_count is remaining % out of 100%. ... View more

i have created alert in one of my search head??? ... View more

can you provide a sample full search for this?? ... View more

hi @jkat54 thnaks for your answer but I want to compare the today event count with yesterday , last and prior week event counts like in the form of line chart like 4 legends. ... View more

In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount ... View more

i would like to include prior week as well. i have modified query to like below mentioned but not working?? index=access_json status>=400 earliest=-360h@h latest=@h | eval startToday = relative_time(now(),"-24h@h") | eval startYesterday = relative_time(now(),"-48h@h") | eval endLastWeek = relative_time(now(),"-168h@h") | eval priorLastWeek = relative_time(now(),"-336h@h") | eval marker = case(_time >= startToday, "Today", _time >=startYesterday,"Yesterday", _time <= endLastWeek,"Last Week",_time <= endLastWeek,"Prior Week", 1=1,"Outside Range") | where marker != "Outside Range" | eval _time = case(marker="Today",_time, marker="Yesterday",_time+86400, marker="Last Week",_time+(7*86400), marker="Last Week",_time+(14*86400) ) | timechart span=1h fixedrange=f count by marker ... View more

@niketnilay actually i am looking for 3 days data comparison perc like today Thursday (08/02/2018) right as per IST. So we should compare with 07/26/2018 and 07/19/2018. 3 days data count percentage difference ?? Can you please let me know ?? ... View more

How to add prior week same day as well and calculate data percentage for 3days ??? Can you please tell me?? ... View more

Is this correct??? index=_internal sourcetype=splunkd log_level!="INFO" earliest=-0d@d latest=now | stats count as Today | appendcols [search index=_internal sourcetype=splunkd log_level!="INFO" earliest=-7d@d latest=-6d@d | stats count as LastWeekSameDay] | appendcols [search index=_internal sourcetype=splunkd log_level!="INFO" earliest=-14d@d latest=-13d@d | stats count as PriorWeekSameDay] | eval perc=abs(round(((PriorWeekSameDay-LastWeekSameDay-Today)/PriorWeekSameDay)*100,2)) Expecting output: Today LastWeekSameDay PriorWeekSameDay Perc 20 120 3649 8x.xx ... View more

same Wednesday only in last week and prior week ... View more

@niketnilay Thanks for you answer and its almost working fine but i would like to include prior week same day (before week of last week same day) as well. ... View more

Hi gokadroid, I have the similar question that is i want to create an alert for specific day count compare with the same day in last week and prior week and make sure that count should be match with 20%(-/+). my query is like index=something source=something "error" | stats count ... View more

i getting results like mentioned below. _time Today LastWeek 06-07-2018 06:01:01 120 1000 06-07-2018 07:11:01 10 1012 06-07-2018 08:01:01 20 1128 06-07-2018 09:05:01 105 1222 06-07-2018 09:41:01 80 06-07-2018 10:15:01 16 06-07-2018 10:22:01 12 06-07-2018 10:51:01 1 two line are showing today time only and LastWeek legend showing today time only instead of lastweek time which is not fully completed. plz find the above attached image. ... View more

Yes i tried but not worked ... View more