Dears,
i want to compare today statistic with the day from last week how can I do that
thank in advance
Hi ahmedhassanean,
try this run everywhere search as admin:
| tstats count WHERE earliest=-7d@d latest=now index=_internal by host, sourcetype, _time
| bucket _time span=1d
| stats last(_time) AS last_time sum(count) AS per_day_count by _time, host, sourcetype
| eval last_week = if(last_time > exact(relative_time(now(),"-8d@d")) AND last_time <= exact(relative_time(now(),"-7d@d")) , per_day_count ,"0")
| eval today = if(last_time > exact(relative_time(now(),"-1d@d")) AND last_time <= exact(relative_time(now(),"-0d@d")) , per_day_count ,"0")
| stats sum(today) AS today sum(last_week) AS last_week by host
It will show you one way to do it by using stats
and counting based on the time of the events. Another way can be using the timewrap
command https://splunkbase.splunk.com/app/1645/ which should be available on Splunk cloud.
Hope this helps ...
cheers, MuS
first many thanks for your support but i already have checked timewrap but what i want to compare for example SPL that end with below .SPL .... | timechart span=1h sum(stats) with same set of any day from last week
As I have written, it shows how it can be done. If the end result does not macho your needs, adapt the search.