Hi Splunkers,
I have been using Splunk for a while and went through many proposed solutions in this community and found none to get what I want. This could be due to high volume of events I have for each month or I am doing something wrong.
So, the challenge I face is that I have a field lets call it "Pages" and I want to compare the last two months customers visiting the top 10 most visited pages.
I have used below query, but the number of events for both months shows the same: (Note: the example below covers the previous day and last day to save time while searching)
Main search...
| addinfo
| eval timephase1=if(_time>=relative_time(info_max_time, "-2d@d"), "last_month", null()), timephase2=if(_time>=relative_time(info_max_time, "-1d@d"), "this_month", null())
| stats count(timephase1) as time1 count(timephase2) as time2 by Pages
| sort -time1
| head 10
Any assistance will be appreciated!
... View more