How to I get the total amount per day or per week ?

[dfigurello]

Hey Splunkers,

I'm using the timewrap and I'm wondering how can I get the total amount per day instead of the average per day? For exemple: I want to know how much the company sold on Monday, to compare with the sales of last Monday...

Could you help about that?

Tks.

[carasso · Accepted solution]

Your example sounds like you want to compare one Monday to the previous Monday.

Try this:

Do your search as usual, and filter at the end (filtering up-front will confuse timechart):

.... 
| timechart count span=1h 
| timewrap w 
| where strftime(_time, "%A") == "Monday"

[MuS]

Hi dfigurello,

based on the answer by caraaso this works like this:

YourSearchHere  earliest=-1w@w
| timechart <insert your search commands to get your event results> span=1h
| timewrap  d series=short
| addtotals s*
| table _time, _span, s1, s8
| rename s1 as last_Monday, s8 as this_Monday

This will search YourSearchHere starting at the start of the week before (-1w@w), then you will timechart your events to your needs so you get your sales numbers, timewrap it and addtotals. After that you show, according to your question, this Monday and last Monday results with the table command and rename s1 and s8 to human readable names.

I did test it with the index=_internal and it worked, so don't blame me if it will not work with your events 😉

hope this helps ...

cheers, MuS