topic line chart comparison between yesterday and todays data in Splunk Enterprise

line chart comparison between yesterday and todays data

selvam_sekar — Wed, 13 Dec 2023 10:11:15 GMT

Hi,

I have requirement to show the line chart comparison between todays count vs previous day. And, I have below SPL but we see the data from yesterday and today, and each graph line is separate.

I want to see the lines together, one superimposed on the other. please could you suggest?

please can you suggest to compare them?

Current SPL:

basesearch earliest=-1d@d latest=now
| eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today")
| timechart span=15m count by Day

Current visualization:

Expected visualization is:

Re: line chart comparison between yesterday and todays data

isoutamo — Wed, 13 Dec 2023 11:01:18 GMT

have you look timewrap command?

You could try something like

basesearch earliest=-1d@d latest=now | timechart span=15m count | timewrap d

Your result shows little bit weird as yesterday you have a whole day, but today is only from midnight to now.

r. Ismo

Re: line chart comparison between yesterday and todays data

selvam_sekar — Wed, 13 Dec 2023 17:00:23 GMT

Thanks @isoutamo . How do we get the comparison between today vs yesterday with some time line.

Currently I am getting yesterday whole day(24 hrs) but today midnight to upto now.

is it possible for us to bring only today (midnight till now) vs same timeframe previous day in the chart?

Current SPL:

basesearch earliest=-1d@d latest=now | timechart span=1h count | timewrap d series=short | fields _time s1 s0 | rename s1 as today, s0 as yesterday

Re: line chart comparison between yesterday and todays data

isoutamo — Wed, 13 Dec 2023 17:20:50 GMT

Maybe not exactly what you are looking, but at least you could cleared out (set to 0) those events like

Re: line chart comparison between yesterday and todays data

selvam_sekar — Fri, 15 Dec 2023 15:29:16 GMT

Thanks @isoutamo . This works as expected 🙂 and only thing is not grouping the the user_id but rather it's grouping by timeformat/_time every 1 hr.

is it possible to group by user_id?

current spl: