All Apps and Add-ons

How to I get the total amount per day or per week ?

dfigurello
Communicator

Hey Splunkers,

I'm using the timewrap and I'm wondering how can I get the total amount per day instead of the average per day? For exemple: I want to know how much the company sold on Monday, to compare with the sales of last Monday...

Could you help about that?

Tks.

1 Solution

carasso
Splunk Employee
Splunk Employee

Your example sounds like you want to compare one Monday to the previous Monday.

Try this:

Do your search as usual, and filter at the end (filtering up-front will confuse timechart):

.... 
| timechart count span=1h 
| timewrap w 
| where strftime(_time, "%A") == "Monday"

View solution in original post

carasso
Splunk Employee
Splunk Employee

Your example sounds like you want to compare one Monday to the previous Monday.

Try this:

Do your search as usual, and filter at the end (filtering up-front will confuse timechart):

.... 
| timechart count span=1h 
| timewrap w 
| where strftime(_time, "%A") == "Monday"

MuS
SplunkTrust
SplunkTrust

Hi dfigurello,

based on the answer by caraaso this works like this:

YourSearchHere  earliest=-1w@w
| timechart <insert your search commands to get your event results> span=1h
| timewrap  d series=short
| addtotals s*
| table _time, _span, s1, s8
| rename s1 as last_Monday, s8 as this_Monday

This will search YourSearchHere starting at the start of the week before (-1w@w), then you will timechart your events to your needs so you get your sales numbers, timewrap it and addtotals. After that you show, according to your question, this Monday and last Monday results with the table command and rename s1 and s8 to human readable names.

I did test it with the index=_internal and it worked, so don't blame me if it will not work with your events 😉

hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...