topic Re: Trend scenario - three dimensional data in Dashboards & Visualizations

Trend scenario - three dimensional data

reverse — Sun, 19 May 2019 11:42:21 GMT

So In my logs I have transaction_id, processing_time, page_id and action done on page action_id
processing time is per action.

I need to show a trend of actions/pages for which daily average processing_time is continuously increasing over a selected time period.

Please guide,

Re: Trend scenario - three dimensional data

DavidHourani — Sun, 19 May 2019 12:14:53 GMT

Hi @reverse,

You're looking for something like this :

... | chart avg(processing_time) values(transaction_id) as transaction_id, values(action_id) as action_id by _time span=1d

You can play around with the span if needed.

More info about using chart command here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Chart

Cheers,
David

Re: Trend scenario - three dimensional data

reverse — Wed, 30 Sep 2020 00:36:12 GMT

it is showing only 1 entry avg(processing_time and all pages listed in single row against a date ..
transaction_id is not relevant here .. page_id is ...

Re: Trend scenario - three dimensional data

reverse — Sun, 19 May 2019 12:42:43 GMT

2019-05-18  187.80
                    A
                    B
                    C
                    D
                    E
                    I

Re: Trend scenario - three dimensional data

reverse — Sun, 19 May 2019 12:44:59 GMT

..as if it is showing avg of all pages

Re: Trend scenario - three dimensional data

DavidHourani — Sun, 19 May 2019 12:45:11 GMT

oh so you want to have your page_idas "by" for the chart ? I thought it's just the _time

Re: Trend scenario - three dimensional data

reverse — Sun, 19 May 2019 12:50:49 GMT

I am trying to find out pages which are deteriorating over time..
each page has actions ..

page_id has multiple action_id (which makes data 3d) and there is also individual transaction processing time for each action on every page..

Re: Trend scenario - three dimensional data

DavidHourani — Sun, 19 May 2019 12:59:59 GMT

okay so from what you're saying, the three dimensions are page_id that contains action_idand we need the avg processing_time for each of the action_id :

 ... | chart avg(processing_time) by transaction_id ,action_id

Re: Trend scenario - three dimensional data

DavidHourani — Sun, 19 May 2019 13:08:23 GMT

You can also add the time using the bucket command and a span..in this case 1hour :

... |bucket span=1h _time | stats avg(processing_time) by transaction_id ,action_id,_time

Re: Trend scenario - three dimensional data

reverse — Wed, 30 Sep 2020 00:36:15 GMT

this worked !.. i replaced transaction_id with page_id

Re: Trend scenario - three dimensional data

reverse — Sun, 19 May 2019 13:22:09 GMT

thanks for your help!!!!!! Now .. more complexity ..
there are 250 pages .. each page has minimum 3 actions ...

I want to show only those results (pages\action combo) for which daily average processing time has increased lets say by 10 % ... or to make it simple ... top 10 worst performing results (pages\action combo) since the start of time range .. example .. comparing today with 7th day before [last 7 days]..
this is really complex...

Re: Trend scenario - three dimensional data

DavidHourani — Sun, 19 May 2019 15:09:34 GMT

hahah you're welcome ! plz up vote the comments and answer and accept and let me see for your next question

Re: Trend scenario - three dimensional data

DavidHourani — Sun, 19 May 2019 15:10:40 GMT

put your other question in another question and post the link here lol I don't really understand this one 😄

Re: Trend scenario - three dimensional data

reverse — Sun, 19 May 2019 16:26:58 GMT

https://answers.splunk.com/answers/747008/trend-scenario-ii-three-dimensional-data.html?minQuestionBodyLength=80

Re: Trend scenario - three dimensional data

reverse — Sun, 19 May 2019 23:33:23 GMT

Since data is in multiple rows by_time. .. I need the difference of last time and first time a nd then top 10 .. so that top 10 slow pages can be identified. Simple