Hi everyone,
I would like to make a chart that compares the result from last year with this year by month.
This is my search :
...| dedup CaseNumber | search ProductName=* IsDeleted=False AccountName="*" CaseRecordTypeName=Standard | eval CreatedDateUNIX=strptime(CreatedDate,"%Y-%m-%d %H:%M:%S") | eval _time=CreatedDateUNIX | where _time>=strptime("2017-01-01 00:00:00","%Y-%m-%d %H:%M:%S") AND _time<=strptime("2017-12-31 23:59:59","%Y-%m-%d %H:%M:%S") | timechart span=1mon count as 2017 | appendcols [dedup CaseNumber | search ProductName=* IsDeleted=False AccountName="*" CaseRecordTypeName=Standard | eval CreatedDateUNIX=strptime(CreatedDate,"%Y-%m-%d %H:%M:%S") | eval _time=CreatedDateUNIX | eval date=_time | eval today=round(relative_time(now(),"@y")) | where date>today | timechart span=1mon count as 2018]
Both searches work well separately, but when i try to combine them, I only see the 2017 data.
If someone could help me, that would be great. I'll be grateful.
Did you get a solution, @MCH2018?
You need the timewrap span=1m
command, see documentation here:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap
I agree. Timewrap is the shortcut needed here. If the op wants to see an example of that, look here: https://answers.splunk.com/answers/145458/can-timewrap-be-utilized-to-only-use-weekdays.html
what if you just did ...| dedup CaseNumber | search ProductName=* IsDeleted=False AccountName="*" CaseRecordTypeName=Standard | eval CreatedDateUNIX=strptime(CreatedDate,"%Y-%m-%d %H:%M:%S")| eval _time=CreatedDateUNIX|timechart span=1mon count|timewrap 1y
and maybe any other filtering you might want to get last year to now. i see you have that in the first search to grab 2017 and you have a different filter to grab 2018.