Hello this search query is very neat and I want to know how I can compare it with last 4 weeks based on the day of week I run this.
index=_internal source=license_usage.log type=Usage
| timechart span=1day sum(b) AS volume_b by idx
ie...today is Tuesday, I want to know the average index usage of the last 4 Tuesdays and compare it with today's date.
pick out the day of the week.
Try something like this:
index=_internal source=license_usage.log type=Usage earliest=-4w@w | eval tdw=upper(strftime(now(),"%A")) | eval cdw=upper(strftime(_time,"%A")) | where cdw==tdw | timechart span=1day sum(b) AS volume_b by idx
Adding the earliest
clause limits you to the last four weeks of data. The first eval
clause computes today's day of the week. The second eval
clause computes the day of the week for each event. Finally, the where
clause compares the two and filters out data that doesn't match.