topic Re: How create line chart showing the count for Current week, prior week and third week? in Dashboards & Visualizations

How create line chart showing the count for Current week, prior week and third week?

SG — Mon, 17 May 2021 07:10:18 GMT

Hi Team,

I am planning to draw the trend of the webpage test speed index trend in Splunk which gives the performance of the speed index for the current week, last week, and last before week. I developed the below query to do the job, but I am not getting the trend and query giving some error. Can someone please help me to draw the trend?

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" | eval myTime=case(test >= relative_time(now(), "-7d"), "CurrentWeek", test >= relative_time(now(), "-14d") AND test < relative_time(now(), "-7d", "PriorWeek", test >= relative_time(now(), "-21d") AND test < relative_time(now(), "-14d", "ThirdWeek", 1=1, "Other") | stats values(speedindex) as score by myTime | eval fast = if(score>0 AND score<2000,score,0) | eval moderate = if(score>=2000 AND score<2999,score,0) | eval slow = if(score>=3000,score,0) | fields - score

Re: How create line chart showing the count for Current week, prior week and third week?

ITWhisperer — Mon, 17 May 2021 09:08:48 GMT

| stats  values(speedindex) as score by myTime

This returns a multi-value field of all the unique scores in the time period. Is that what you were expecting?

Re: How create line chart showing the count for Current week, prior week and third week?

SG — Mon, 17 May 2021 09:26:49 GMT

I modified the query to get speed index values as per the week

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" earliest=-7d@d | eval myTime=case(_time >= relative_time(now(), "-7d"), "CurrentWeek", _time >= relative_time(now(), "-14d") AND _time < relative_time(now(), "-7d"), "PriorWeek", _time >= relative_time(now(), "-21d") AND _time < relative_time(now(), "-14d"), "ThirdWeek", 1=1, "Other") | stats values(speedindex) as score by myTime

Now i am getting data in the statistics panel as below.

But i am not getting any trend in the visualization panel.

Re: How create line chart showing the count for Current week, prior week and third week?

SG — Mon, 17 May 2021 10:34:23 GMT

I got to know that "values" function is giving results as a string, that's the reason I am not getting any trend.

Can you please tell me instead of "values", which function i can use to get the trend?

Re: How create line chart showing the count for Current week, prior week and third week?

SG — Tue, 18 May 2021 05:20:12 GMT

I could get data week wise using "timewrap" function in splunk.

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" earliest=-21d@d | timechart span=1h list(speedindex) as score | timewrap w

Source - https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Timewrap