topic Re: Trend scenario II- three dimensional data in Getting Data In

Trend scenario II- three dimensional data

reverse — Sun, 19 May 2019 16:26:34 GMT

https://answers.splunk.com/answers/746994/trend-scenario-three-dimensional-data.html#comment-747409

Extending this problem ...I want to show only those results (pages\action combo) for which daily average processing time has worsen the most... let's say by 10 % ... or to make it simple ... top 10 worst performing results (pages\action combo) since the start of time range .. example .. comparing today with 7th day before [last 7 days]..
this is really complex...

Re: Trend scenario II- three dimensional data

nabeel652 — Mon, 20 May 2019 00:14:30 GMT

you mean you want to compare this Monday with last Monday and so on?

Re: Trend scenario II- three dimensional data

reverse — Mon, 20 May 2019 00:25:05 GMT

yo got it .. whatever is the date range .. last day -first day and worse 10

Re: Trend scenario II- three dimensional data

nabeel652 — Mon, 20 May 2019 01:06:01 GMT

You can modify this code according to your requirements:

| eval day_of_week=strftime(_time,"%w")  | stats sum(count) as sum by day_of_week _time | sort by day_of_week | streamstats last(sum) as lastSum  current=false window=1 | where isnotnull(lastSum) | eval change = (sum-lastSum)/lastSum*100 | where change>15

Re: Trend scenario II- three dimensional data

nabeel652 — Wed, 30 Sep 2020 00:36:23 GMT

day_of_week is 0-6 (Sunday-Saturday)

Re: Trend scenario II- three dimensional data

DavidHourani — Mon, 20 May 2019 06:02:38 GMT

do you always have values for your pages ? Because in this case if it's a new page with bad performance it won't show at all.

Re: Trend scenario II- three dimensional data

DavidHourani — Mon, 20 May 2019 06:16:00 GMT

Hi again @reverse,

So starting with this from the previous question :

 ... |bucket span=1h _time | stats avg(processing_time) as average_processing_time by page_id ,action_id,_time

You have to add this :

| eval week_day=strftime(_time,"%w") 
| eventstats avg(average_processing_time) as average_trend by week_day, page_id ,action_id
| eval processing_time_change=(average_processing_time/average_trend)*100 
| where processing_time_change>10 
| sort 10 -processing_time_change

This will first build an avg for a specific results over the same day of the previous weeks. Then calculate the current change in processing time compared to the overall average. Then give you the top 10 biggest changes.

Cheers,
David

Re: Trend scenario II- three dimensional data

reverse — Mon, 20 May 2019 18:45:41 GMT

it says - "No results found."

Re: Trend scenario II- three dimensional data

reverse — Wed, 30 Sep 2020 00:37:02 GMT

no results after eventstats

|bucket span=1d _time | stats avg(tran_time_ms) by page_id ,action,_time| eval week_day=strftime(_time,"%w")
| eventstats avg(average_processing_time) as average_trend by week_day, page_id ,action_id

Re: Trend scenario II- three dimensional data

DavidHourani — Wed, 30 Sep 2020 00:38:34 GMT

ah yes, you're not using the same fields in your stats and eventstats, make sure you align your field names and use the ones from your logs for tran_time_ms, action and the rest ^^