Splunk Search

How to compare two weeks ?

falcom92
Engager

Hi,

I use Splunk 6.2.

I try to compare two values between two differents weeks.

index="market_logs" host="12.0.0.1" OR host="12.0.0.2" 
AND status="rejected" OR status="error" 
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| eval r_before =
    [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2" 
    AND status="rejected" OR status="error" 
    AND srcip="192.168.0.1" OR srcip="192.168.0.2" 
    earliest=-14d@h latest=-7d@h
    | stats count] 
| stats count AS r_now

But it doesn't work. I have the following error : "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])."

I use a script who extract the two values.

Can someone help me please ?

Thanks,

falcom92

0 Karma
1 Solution

falcom92
Engager

I find the solution with append and it works.

index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| stats count
| append [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
earliest=-14d@h latest=-7d@h
| stats count]

Thanks.

View solution in original post

0 Karma

falcom92
Engager

I find the solution with append and it works.

index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
| stats count
| append [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2"
AND status="rejected" OR status="error"
AND srcip="192.168.0.1" OR srcip="192.168.0.2"
earliest=-14d@h latest=-7d@h
| stats count]

Thanks.

0 Karma

markthompson
Builder

Hi Falcom,
For ease of use I'd recommend the timewrap app, it adds an extra command/function to the search which lets you set a span, either by day, by week, by month for 1 search, which could help improve search speeds.

MuS
SplunkTrust
SplunkTrust

I second this or use stats which will out-perform anything else - especially on long runs over a bigger time range.
Any kind of sub search such be your last resort not your first choice ....

MuS
SplunkTrust
SplunkTrust

Hi falcom92,

use the timewrap app https://apps.splunk.com/app/1645 which will handle such things or take a look at this answer http://answers.splunk.com/answers/185829/how-to-create-a-custom-macro-function-inside-the-s.html to get an idea how it can be done using some stats commands.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...