Month over month report based on day type

[samsplunkd]

Hi,

I am looking for something in splunk which could create month over month reports but not based on dates but days i.e. comparing 1st Sunday of May with 1st Sunday of June, 1st Monday of May with 1st Monday of June, 2nd Sunday of May with 2nd Sunday of June, so on......
I have already seen "month over month reports" question posted earlier on splunk but couldn't find what I was looking. Hence creating a new one.

Basically I want to compare two months but in a different way than already explained in this forum. Here it goes: Considering May 2012 and June 2012 as an example: May 2012 starts with Tuesday and June 2012 starts with Friday. So first Tuesday of May is 1st May but 1st Tuesday for June is 5th June Similarly, 1st Friday for May is 4th May but its 1st June for June month. What I want to do is compare the data for 1st Tuesday of May (1st May 2012) with 1st Tuesday of June (5th June 2012), 1st Friday of May (4th May 2012) with 1st Friday of June (1st June 2012). Similarly for other days...1st Sunday, 2nd Sunday, 2nd Tuesday, 2nd Friday, 3rd Friday, 3rd Thursday and so on....... This is to ensure comparison is not sensitive to start, mid and end of month.. Hope it clarifies.. Let me know if you need more details.. Thanks for helping.. Much appreciate it:).

Please help.

Rgds

[kristian_kolb]

dwaddles suggestion just selects the events and then does some stats on them, but it is not enough to produce a timechart for two simultaneous timelines. You could of course make it more specific, e.g.;

sourcetype=xyz date_wday=tuesday date_month=may OR date_month=june date_mday<8 

To make a comparison like you want, I believe you should look through this;

http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/

http://splunk-base.splunk.com/answers/49933/splunk-chart-of-two-timeperiods

Hope this helps,

Kristian

[dwaddle]

This may not give you exactly what you're looking for, but there is date_mday and date_wday which are indexed fields produced by timestamp extraction. (These do not exist in 100% of events, so that could be an issue). It's a pretty safe bet that the first xxxday of the month is in the first 7 days of the month. So you could do

sourcetype=foo date_mday<=7 | stats count by date_wday

[samsplunkd]

Thanks for answering But I dint quite understand how this will help in overlaying current month over previous month using the way explained above. Can you please explain more?

[samsplunkd]

Hi Iguinn, I have provided more details below. There weren't enough characters in the comment area.

Thanks

[samsplunkd]

Thanks Iguinn. Sorry for not explaining in detail before. Basically I want to compare two months but in a different way than already explained in this forum. Here it goes:
Considering May 2012 and June 2012 as an example:
May 2012 starts with Tuesday and June 2012 starts with Friday. So first Tuesday of May is 1st May but 1st Tuesday for June is 5th June Similarly, 1st Friday for May is 4th May but its 1st June for June month. What I want to do is compare the data for 1st Tuesday of May (1st May 2012) with 1st Tuesday of June (5th June 2012), 1st Friday of May (4th May 2012) with 1st Friday of June (1st June 2012). Similarly for other days...1st Sunday, 2nd Sunday, 2nd Tuesday, 2nd Friday, 3rd Friday, 3rd Thursday and so on....... This is to ensure comparison is not sensitive to start, mid and end of month.. Hope it clarifies.. Let me know if you need more details..
Thanks for helping.. Much appreciate it:).

[lguinn2]

If you can give more details in your question, maybe I can give you an answer. It is hard for me to visualize exactly what you want to do. Are you comparing error counts on the various days ...