topic Re: Compare two different values from two different periods in Splunk Search

Compare two different values from two different periods

exocore123 — Wed, 24 Mar 2021 22:59:22 GMT

I saw a few examples

https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-search-results-from-two-different-time-periods/m-p/221177

https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-time-same-time-frames-with-different-day-s/m-p/504217

But these queries arent exact doing what I want to do. I basically want to do a 10min interval from now to 10 minutes ago. And compare it against the value from -24h and -24h (and 10 minutes before that) to do a comparison between the values. Whether it is in day to day trend for that 10min period

index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-24h latest=-1h | eval period=if(_time>=relative_time(now(),"-23h"),"current","previous") | chart count(request) over request by period | eval difference=abs(previous-current)/previous*100 | table request difference previous current

Does anyone has an idea?

Re: Compare two different values from two different periods

exocore123 — Wed, 24 Mar 2021 23:07:59 GMT

Actually I think I solved it

index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h | stats count AS previous by request | appendcols [search index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now | stats count AS current by request] | eval difference=abs(previous-current)/previous*100

Re: Compare two different values from two different periods

bowesmana — Thu, 25 Mar 2021 06:16:31 GMT

Why don't you just set your initial search to capture the two periods of data like this

(index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-1450m latest=-1440m) OR (index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-10m latest=now) | eval period=if(_time>=relative_time(now(),"-23h"),"current","previous") | chart count(request) over request by period | eval difference=abs(previous-current)/previous*100 | table request difference previous current

The rest of your search is fine.

Re: Compare two different values from two different periods

bowesmana — Thu, 25 Mar 2021 06:22:37 GMT

@exocore123

Using appendcols will not be as fast as using a single search and also you have to be totally sure that the requests from the previous time period all exist in the current time period otherwise your appendcols will generate the counts out of sync, so the rows won't match.

(index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h) OR (index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now)

Use this as your single search and then do your previous logic.

Re: Compare two different values from two different periods

exocore123 — Thu, 25 Mar 2021 07:33:01 GMT

Good point - I dont know why I didnt think of that - I'll try this