https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194896#M12156 <P>My data looks something like this <BR /> C1 C2 C3 C4 date <BR /> 1 2 3 4 xx-xx-xxxx<BR /> 3 4 3 1 xx-xx-xxxx<BR /> 5 6 7 6 xx-xx-xxxx</P> <P>C1 C2 C3 C4 date <BR /> 4 5 3 4 yy-yy-yyyy<BR /> 2 4 6 1 yy-yy-yyyy<BR /> 7 4 7 0 yy-yy-yyyy</P> <P>I am to extract this data from two different dates and compare their means etc. <BR /> How should I proceed ? <BR /> Any suggestions are welcome. </P> <P>What I want to do : <BR /> Extract data from both dates in a single query <BR /> compare means on each column in both sets<BR /> display output in the form of a range map or a tabset icon inline.</P> Wed, 26 Aug 2015 21:01:55 GMT m_vivek 2015-08-26T21:01:55Z https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194896#M12156 <P>My data looks something like this <BR /> C1 C2 C3 C4 date <BR /> 1 2 3 4 xx-xx-xxxx<BR /> 3 4 3 1 xx-xx-xxxx<BR /> 5 6 7 6 xx-xx-xxxx</P> <P>C1 C2 C3 C4 date <BR /> 4 5 3 4 yy-yy-yyyy<BR /> 2 4 6 1 yy-yy-yyyy<BR /> 7 4 7 0 yy-yy-yyyy</P> <P>I am to extract this data from two different dates and compare their means etc. <BR /> How should I proceed ? <BR /> Any suggestions are welcome. </P> <P>What I want to do : <BR /> Extract data from both dates in a single query <BR /> compare means on each column in both sets<BR /> display output in the form of a range map or a tabset icon inline.</P> Wed, 26 Aug 2015 21:01:55 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194896#M12156 m_vivek 2015-08-26T21:01:55Z https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194897#M12157 <P>Take a look at the Timewrap app: <A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> Wed, 26 Aug 2015 22:32:56 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194897#M12157 masonmorales 2015-08-26T22:32:56Z https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194898#M12158 <P>If I am correct you have two time ranges to be compared in one report- </P> <P>-<A href="http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/">http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/</A></P> <P>Use date format instead of relative time.</P> Wed, 26 Aug 2015 22:35:15 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194898#M12158 jensonthottian 2015-08-26T22:35:15Z https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194899#M12159 <P>Getting both sets of results based on the choice of dates in a single query is <BR /> how far I have got till now. take a look. </P> <PRE><CODE>index=abcd host=pqrs* earliest=07/01/2015:00:0:0 latest=07/02/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE | eval dataset=1 | append[index=abcd host=pqrs* earliest=07/03/2015:00:0:0 latest=07/04/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE | eval dataset=2] </CODE></PRE> <P>abcd pqrs are just for an idea. </P> <P>My next step is to calculate means of each field/column for the corresponding data set and compare the means and output the results of the comparison in the form of a rangemap or tabset icon(inline). </P> <P>Any suggestions/recommendations are welcome.<BR /> Thanks</P> Wed, 26 Aug 2015 22:57:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194899#M12159 m_vivek 2015-08-26T22:57:46Z https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194900#M12160 <P>Thank you for that @jensonthottian. <BR /> But,<BR /><BR /> I have about 180 items/fields that are being measured. I need to do a statistical analysis on each of the 180 fields/entities and then compare them over the time ranges. </P> <P>How should I proceed in this case? </P> Mon, 31 Aug 2015 17:29:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Comparing-data-on-two-sets-obtained-from-two-different-date/m-p/194900#M12160 m_vivek 2015-08-31T17:29:00Z