https://community.splunk.com/t5/Getting-Data-In/3d-data-parsing-and-visualization/m-p/379597#M68587 <OL> <LI>my logs contain transactions</LI> <LI>each transaction has <CODE>page_id</CODE> , <CODE>action_id</CODE> and <CODE>time_taken</CODE></LI> <LI>there are over 300 pages with each page having 3 actions</LI> </OL> <P>I want to show only those results (pages\action combo) for which daily average processing time (<CODE>time_taken</CODE>) has worsen the most... let's say by 10 % ... or to make it simple ... top 10 worst performing results (pages\action combo) since the start of time range and today<BR /> for example - for last 30 days time range in datepicker- comparison of today and -30 days ans so on.<BR /> this is really complex...</P> Mon, 20 May 2019 21:49:00 GMT reverse 2019-05-20T21:49:00Z https://community.splunk.com/t5/Getting-Data-In/3d-data-parsing-and-visualization/m-p/379597#M68587 <OL> <LI>my logs contain transactions</LI> <LI>each transaction has <CODE>page_id</CODE> , <CODE>action_id</CODE> and <CODE>time_taken</CODE></LI> <LI>there are over 300 pages with each page having 3 actions</LI> </OL> <P>I want to show only those results (pages\action combo) for which daily average processing time (<CODE>time_taken</CODE>) has worsen the most... let's say by 10 % ... or to make it simple ... top 10 worst performing results (pages\action combo) since the start of time range and today<BR /> for example - for last 30 days time range in datepicker- comparison of today and -30 days ans so on.<BR /> this is really complex...</P> Mon, 20 May 2019 21:49:00 GMT https://community.splunk.com/t5/Getting-Data-In/3d-data-parsing-and-visualization/m-p/379597#M68587 reverse 2019-05-20T21:49:00Z