Knowledge Management

How to compare index usage for specific day within last 4 weeks?

tlow
Explorer

Hello this search query is very neat and I want to know how I can compare it with last 4 weeks based on the day of week I run this.

index=_internal source=license_usage.log type=Usage
| timechart span=1day sum(b) AS volume_b by idx

ie...today is Tuesday, I want to know the average index usage of the last 4 Tuesdays and compare it with today's date.

pick out the day of the week.

Tags (3)
0 Karma

aweitzman
Motivator

Try something like this:

index=_internal source=license_usage.log type=Usage earliest=-4w@w | eval tdw=upper(strftime(now(),"%A")) | eval cdw=upper(strftime(_time,"%A")) | where cdw==tdw | timechart span=1day sum(b) AS volume_b by idx

Adding the earliest clause limits you to the last four weeks of data. The first eval clause computes today's day of the week. The second eval clause computes the day of the week for each event. Finally, the where clause compares the two and filters out data that doesn't match.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...