Splunk Search

How to display counts in the two weeks span for last two weeks and two weeks before

AshChakor
Path Finder

I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday

For example. 

_time

Count

2020-11-28

164

2020-12-05

488

2020-12-12

516

2020-12-26

5755

2021-01-02

482

2021-01-09

450

2021-01-16

1274

2021-01-23

33684

 

Expected Output is :

With two weeks time span I want to display the counts as below

 

Four weeks before  (164+488+516+5755)

Two weeks before  (450+482)

Latest two weeks    34958  ( which is count of 2021-01-16 and 2021-01-23  1274 + 33684)

 

Labels (3)
0 Karma

AshChakor
Path Finder

I found a solution but let me know if anyone has any better solution 

index="my index" | where <condition>
| timechart span=1w@w6 count as eachwcount
| eval latest_2weeks=relative_time(now(),"-1w@w6")
| eval two_weeks_before = relative_time(now(),"-3w@w6")
| eval four_weeks_before = relative_time(now(),"-5w@w6")
| eval weeksAgo=case(_time < two_weeks_before, "Four_Weeks_Before", _time >= two_weeks_before and _time < latest_2weeks," Two_Weeks_Before",_time >= latest_2weeks,"Latest_Two_Weeks")
| stats sum(eachwcount) as totalcount by weeksAgo

 

AshChakor_0-1611946587229.png

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...