topic Re: How to compare two time same time frames with different day's. in Splunk Search

How to compare two time same time frames with different day's.

rchams — Fri, 12 Jun 2020 17:51:57 GMT

How to compare the average value of the field in two different time frames i.e same time today with same time yesterday.

Compare the today time frame with yesterday's time frame.

Re: How to compare two time same time frames with different day's.

richgalloway — Fri, 12 Jun 2020 18:16:06 GMT

Depending on your query, you may be able to use the timewrap command.

Re: How to compare two time same time frames with different day's.

rchams — Fri, 12 Jun 2020 20:19:39 GMT

If i use timewrap it gives the total day average like yesterday total average comparing with today time frame(example like last 60mins). I'm looking for the search to compare the average value in the same time frame like 1 pm to 1.30 pm today with 1 pm to 1.30 pm yesterday.

my search is :

index=XXXX sourcetype=XXXXX esb_service="XXXXXX" esb_environment=prod esb_event=esbRespBE
| eval esb_backend_time=round(esb_backend_time/1000,2)
| bin _time span=15m
| stats max(esb_backend_time) as response_time by esb_service,_time
| eval response_time = round(response_time,2)

Re: How to compare two time same time frames with different day's.

to4kawa — Fri, 12 Jun 2020 21:17:37 GMT

| eval date=if(strftime(now(),"%F")=strftime(_time,"%F"),"today","yesterday")

| eval _time=strftime(_time,"%T")

| xyseries _time date response_time

Re: How to compare two time same time frames with different day's.

rchams — Mon, 15 Jun 2020 14:02:40 GMT

@to4kawa @Hi Thanks for the query.

It's comparing total day, i'm looking for specific time frame today with yesterday. The query which you provided gives the today all day time frame comparison with yesterday all day comparison, if i'm looking 1 hr window for today need to compare with same 1 hr time frame yesterday only. Only those results needs to be displayed.

Re: How to compare two time same time frames with different day's.

to4kawa — Mon, 15 Jun 2020 21:24:42 GMT

I didn't see any such requirement from the first question and your query.

and your query is span=15min

for 1 hour comparison, How are you going to aggregate 4 values?

Please summarize what you want to do before you ask the question again and again.

Re: How to compare two time same time frames with different day's.

rchams — Wed, 17 Jun 2020 02:06:41 GMT

@to4kawa

I want to compare the average response time value in 1 hr for span=15 mins to same 1 hr time in yesterday (like 4 aggregate values).

example i want to compare the average response time for the period 06/15/2020 3 PM to 4 PM with 06/16/2020 3 PM to 4 PM . Only 4 aggregate comparison values should be appear as my results.
average value comparison

Looking for results like below

timeframe today-value yesterday-value

15.15.00 00000 00000

15.30.00 44444 44444

15.45.00 11111 11111

16.00.00 22222 22222

Re: How to compare two time same time frames with different day's.

to4kawa — Wed, 17 Jun 2020 09:32:56 GMT

please modify my query.

the result contains what you want.