All Apps and Add-ons

How to build a search to compare this year's data with previous years without using timechart?

himynamesdave
Contributor

Hello all,

I have a simple search:

 | chart count BY field

To help you visualise the output, see here: http://imgur.com/m3W0gct

What I want to do is compare this count year on year, without using a timeseries chart - one line for each year with a distribution of count. Like this: http://imgur.com/MVwBYXx

It's similar to this, but slightly different re: time: http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/

I am happy using subsearches to bucket the times into years, but struggling to finish the search. An example is something like this (using days here, not years):

index=index earliest=-0d@d latest=now | append [search index=index earliest=-1d@d latest=-0d@d]

What's the best way to build this search for this? Would love some help 🙂

1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

@himynamesdave

I would suggest first extracting the year, then adding that to your by clause.

index=cdc
| eval the_year = strftime(_time, "%Y")
| chart count by MAGER_, the_year

That should give you what you need. You can use a different strftime value you extract a different part of the timestamp if you look at the common time variables here.

Here's an example from buttercup games data:
alt text

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

@himynamesdave

I would suggest first extracting the year, then adding that to your by clause.

index=cdc
| eval the_year = strftime(_time, "%Y")
| chart count by MAGER_, the_year

That should give you what you need. You can use a different strftime value you extract a different part of the timestamp if you look at the common time variables here.

Here's an example from buttercup games data:
alt text

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...