Splunk Search

day by day comparison

fwd4
Explorer

I'm trying to build a graph in Splunk to provide a day-by-day comparison of particular response codes.

For example I currently monitor the last 24 hours of logs looking for a string D101 (resp_code="D101") and graph it in a timechart. What I would like to do is run a second query for the same D101 message but from the previous 24hours - then end result being a graph with 2 lines showing me today against yesterday.

resp_code="D101" latest=now earliest=-24h | timechart count by resp_code | appendcols [resp_code="D101" latest=-24h earliest=-48h | timechart count by resp_code]

I think I need to be looking in or around the appendcols function but I'm receiving the below error, it's obviously not parsing what I've written in the way I'd hope:

"Search operation 'resp' is unknown. You might not have permission to run this operation."

Am I barking up the wrong tree with appendcols, should I be doing this a different way?

0 Karma
1 Solution

JYTTEJ
Communicator

You need to add the search command: [search resp_code....

View solution in original post

JYTTEJ
Communicator

You need to add the search command: [search resp_code....

fwd4
Explorer

great much appreciated!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...