topic Re: splunk timepicker dashboard shows result for today and yesterday in Dashboards & Visualizations

Why does splunk timepicker dashboard shows result for today and yesterday?

mikeyty07 — Thu, 24 Aug 2023 17:29:09 GMT

I have a requirement to build a dashboard, when selected between through date and time range
suppose 8/16/2023 17:00:00 and 8/16/2023 18:00:00. And want to show results for these dates as well as the previous day same hour results

todays count	yesterdays count
100	200

is it possible to have auto search and show two results through one time picker selection?

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Wed, 23 Aug 2023 22:24:04 GMT

You could try something like this

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Thu, 24 Aug 2023 02:54:39 GMT

I added in top of query its showing data in _raw format instead of table. Am I missing anything?
my query

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Thu, 24 Aug 2023 08:21:50 GMT

Yes, you still need to do the counts - I assumed you knew how to do that - all I was showing was how to get the previous day's events using the timepicker (as you asked).

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Thu, 24 Aug 2023 13:19:26 GMT

thanks, It worked. Also in the same query is it possible to get from the last week day too including today and yesterday?

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Thu, 24 Aug 2023 13:21:32 GMT

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Thu, 24 Aug 2023 14:14:12 GMT

I wanted to check the percent increase/ decrease on the same query is it possible to run it on same?

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Thu, 24 Aug 2023 14:46:50 GMT

Try something like this

index=main source="*eligible*" "/api/info/eligible" [| makeresults | addinfo | eval row=mvrange(0,3) | mvexpand row | eval row=if(row=2,7,row) | eval earliest=relative_time(info_min_time,"-".row."d") | eval latest=relative_time(info_max_time,"-".row."d") | table earliest latest] | bin _time span=1d | stats count by _time | eval day=case(_time>=relative_time(now(),"@d"),"Today",_time>=relative_time(now(),"-1d@d"),"Yesterday",true(),"LastWeek") | eval {day}=count | fields - count _time | stats values(*) as * | eval dailychange=100*Today/Yesterday | eval weeklychange=100*Today/LastWeek

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Thu, 24 Aug 2023 14:54:21 GMT

thank you, it worked but for percentage calculation i did this

| eval dailychange=(((Today-Yesterday)/Today)*100)
| eval weeklychange=(((Today-LastWeek)/Today)*100)

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Thu, 24 Aug 2023 15:22:59 GMT

when i try to use time picker like certain date and time it is showing me like

lastweek

day

25027

25161

25231

lastweek

but when i do last 4 hours or minutes all the values are showing like

today

yesterday

lastweek

dailychange

day

weeklychange

999249

102972

101160

-3.75

lastweek

today

yesterday

-1.92

can the timepicker show results like all values in the second table?

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Thu, 24 Aug 2023 16:18:25 GMT

Perhaps you need to calculate based on info_min_time?

index=main source="*eligible*" "/api/info/eligible" [| makeresults | addinfo | eval row=mvrange(0,3) | mvexpand row | eval row=if(row=2,7,row) | eval earliest=relative_time(info_min_time,"-".row."d") | eval latest=relative_time(info_max_time,"-".row."d") | table earliest latest] | bin _time span=1d | stats count by _time | addinfo | eval day=case(_time>=relative_time(info_min_time,"@d"),"Today",_time>=relative_time(info_min_time,"-1d@d"),"Yesterday",true(),"LastWeek") | eval {day}=count | fields - count _time info_* | stats values(*) as * | eval dailychange=100*Today/Yesterday | eval weeklychange=100*Today/LastWeek

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Fri, 25 Aug 2023 02:39:55 GMT

It still shows same but instead gives today

today

day

25027

25161

25231

today

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Fri, 25 Aug 2023 02:51:22 GMT

Sorry I missed removing the day field

index=main source="*eligible*" "/api/info/eligible" [| makeresults | addinfo | eval row=mvrange(0,3) | mvexpand row | eval row=if(row=2,7,row) | eval earliest=relative_time(info_min_time,"-".row."d") | eval latest=relative_time(info_max_time,"-".row."d") | table earliest latest] | bin _time span=1d | stats count by _time | addinfo | eval day=case(_time>=relative_time(info_min_time,"@d"),"Today",_time>=relative_time(info_min_time,"-1d@d"),"Yesterday",true(),"LastWeek") | eval {day}=count | fields - count _time info_* day | stats values(*) as * | eval dailychange=100*Today/Yesterday | eval weeklychange=100*Today/LastWeek

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Fri, 25 Aug 2023 03:21:43 GMT

It only showed this now,

today

25027

25161

25231

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Fri, 25 Aug 2023 08:35:05 GMT

Please share your full query in a code block </>

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Fri, 25 Aug 2023 14:00:58 GMT

index=main source="*eligible*" "/api/info/eligible"
[| makeresults
| addinfo
| eval row=mvrange(0,3)
| mvexpand row
| eval row=if(row=2,7,row)
| eval earliest=relative_time(info_min_time,"-".row."d")
| eval latest=relative_time(info_max_time,"-".row."d")
| table earliest latest]
| bin _time span=1d
| stats count by _time
| addinfo
| eval day=case(_time>=relative_time(info_min_time,"@d"),"Today",_time>=relative_time(info_min_time,"-1d@d"),"Yesterday",true(),"LastWeek")
| eval {day}=count
| fields - count _time info_* day
| stats values(*) as *
| eval dailychange=100*Today/Yesterday
| eval weeklychange=100*Today/LastWeek

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Fri, 25 Aug 2023 15:00:17 GMT

Sorry, I should have used info_max_time

index=main source="*eligible*" "/api/info/eligible" [| makeresults | addinfo | eval row=mvrange(0,3) | mvexpand row | eval row=if(row=2,7,row) | eval earliest=relative_time(info_min_time,"-".row."d") | eval latest=relative_time(info_max_time,"-".row."d") | table earliest latest] | bin _time span=1d | stats count by _time | addinfo | eval day=case(_time>=relative_time(info_max_time,"@d"),"Today",_time>=relative_time(info_max_time,"-1d@d"),"Yesterday",true(),"LastWeek") | eval {day}=count | fields - count _time info_* day | stats values(*) as * | eval dailychange=100*Today/Yesterday | eval weeklychange=100*Today/LastWeek

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Fri, 25 Aug 2023 21:16:38 GMT

now its showing on two column, today column is missing

lastweek

yesterday

101160

102972

999249

Re: splunk timepicker dashboard shows result for today and yesterday

ITWhisperer — Sat, 26 Aug 2023 20:49:07 GMT

What time span did you have in your search?

Re: splunk timepicker dashboard shows result for today and yesterday

mikeyty07 — Mon, 28 Aug 2023 17:33:40 GMT

I selected from time picker like 8/14/23 00:00:00 8/15/23 00:00:00