Splunk Search

Trending a calculation

jgolovich
New Member

I am currently using this search string to determine the number of defects based but I would like to expand it so I can trend it over multiple weeks.

sourcetype="qualys" OSgroup=APPLE | stats count(eval(severity="4" or severity="5")) AS total_severity, dc(Hostname) AS total_devices | eval defects=(total_severity/total_devices)

The above string provides me the data for the time selected (which is generally the past 7 days).

What I would like to do it provide the defects for the current week, prior week, prior prior week, etc.

Thoughts?

Tags (3)
0 Karma

lpolo
Motivator
0 Karma

lguinn2
Legend

Try

sourcetype="qualys" OSgroup=APPLE | 
bucket _time span=7d |
stats count(eval(severity="4" or severity="5")) AS total_severity, dc(Hostname) AS total_devices by _time | 
eval defects=(total_severity/total_devices)

and search over the past 28 days or whatever. This will bucket in 7-day periods, not Sun-Sat.

0 Karma

lguinn2
Legend

I also like dwaddle's answer, although I don't think that is the search that you want.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

timechart is your friend. You may want to rewrite your search some however. Something like this may get close:

sourcetype="qualys" OSgroup=APPLE ( severity=4 OR severity=5 )
| timechart span=1w count(severity),dc(Hostname) AS total_devices 
| eval defects=(total_severity/total_devices)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...