Splunk Search

How to create a timechart that makes same search run for a different date range in a single chart

nkumar6
Explorer

I have a search string that runs a SQL search and returns two columns (items and count) from DB.
I run this search on a dashboard for checking today's count vs last week count

i.e. making the same search run for a different date range, one for today and one for -7d@d.

index=abc source=item_count 
|dedup item
|table item,count
|sort item

I want to make a timechart where I can compare it in a single chart rather than running two searches side by side.

0 Karma
1 Solution

oscar84x
Contributor

Hi. you can try a subsearch to get the results from the previous week and then appending the results to the outer search for the current day. It's difficult not having the actual data but the search below might do the trick.

 index=abc source=item_count earliest=@d latest=now
 |dedup item
 |table item,count
 |sort item
 | rename count as TodayCount
    |appendcols [search index=abc source=item_count earliest=-7d@d latest=-6d@d
    |dedup item
    |table item,count
    |sort item
    | rename count as lastWeekCount
    | fields lastWeekCount]

View solution in original post

0 Karma

nikita_p
Contributor

Hi nkumar6,
You can try the search below for last 7 days to compare 7 days data.
Splunk Query: index=abc source=item_count |dedup item | timechart span=1d count by item

0 Karma

oscar84x
Contributor

Hi. you can try a subsearch to get the results from the previous week and then appending the results to the outer search for the current day. It's difficult not having the actual data but the search below might do the trick.

 index=abc source=item_count earliest=@d latest=now
 |dedup item
 |table item,count
 |sort item
 | rename count as TodayCount
    |appendcols [search index=abc source=item_count earliest=-7d@d latest=-6d@d
    |dedup item
    |table item,count
    |sort item
    | rename count as lastWeekCount
    | fields lastWeekCount]
0 Karma

nkumar6
Explorer

Thanks, It worked.

0 Karma

oscar84x
Contributor

Great! Glad to help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...