Dashboards & Visualizations

How to show last weeks data in trellis for single value visualization?

mukhil
New Member

Hi,

Im working on showing last week data in trellis for single value visualization. I have 7 values in trellis which is showing current week's data. I would like to see last week data as well in form of providing token to it, but unable to perform. Please help me in it.

0 Karma

woodcock
Esteemed Legend
0 Karma

jodyfsu
Path Finder

I think you might be looking for something like this:

index=INDEX sourcetype=SOURCETYPE "REST OF SEARCH"
 earliest=-8d@d latest=-1d@d 
| multikv 
| eval ReportKey="Last Week" 
| append 
    [ search index=INDEX sourcetype=SOURCETYPE "REST OF SEARCH"
 earliest=-15d@d latest=-8d@d
    | multikv 
    | eval ReportKey="Previous Week" 
    | eval _time=_time+60*60*24*7] 
| stats FUNCTION by ReportKey 

I use this to compare weeks without having to do each week manually.

0 Karma

woodcock
Esteemed Legend

Just stack the time specifiers like this:

index=?INDEX sourcetype=SOURCETYPE "REST OF SEARCH" (earliest=-8d@d latest=-1d@d OR earliest=-15d@d latest=-8d@d)
| multikv
| timechart span=1w FUNCTION
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...