topic Re: compare response time from yesterday to today in Splunk Search

compare response time from yesterday to today

mightaswelby — Tue, 29 Sep 2020 16:10:25 GMT

Trying to compare response time from yesterday to today. This search seems to be working, but very, very slow. Any suggestions on how to improve it?

Re: compare response time from yesterday to today

cmerriman — Fri, 13 Oct 2017 17:42:05 GMT

could you try this:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=now
| eval Duration_Sec = duration/1000
| multikv 
| eval ReportKey=if(_time>=relative_time(now(),"@d"),"Today","Yesterday")
| timechart span=60m avg(Duration_Sec) by ReportKey

I'm basically just trying to remove the subsearch in general and compiling ReportKey into one eval statement to define today and yesterday.

if you need yesterdays time to be shifted a day, add |eval _time=if(ReportKey="Yesterday",_time+86400,_time) before the timechart

Re: compare response time from yesterday to today

sshelly_splunk — Tue, 29 Sep 2020 16:10:35 GMT

Have you tried the timewrap command? I just did this, and if you choose Line Chart in visualization, looks pretty cool, and seems to be pretty fast:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-2d@d
|eval Duration=duration/1000
| timechart avg(Duration) span=1h
| timewrap series=relative 24h

I obviously used different data:) I did it w/apache logs, and used response_time to generate the viz.

Re: compare response time from yesterday to today

cmerriman — Fri, 13 Oct 2017 17:46:29 GMT

after looking again, i see your shifting Yesterday a week ahead, [60*60*24*7] . you can use 604800 in the _time eval i provided, i'm just not sure why you're shifting it a week.

Re: compare response time from yesterday to today

DalJeanis — Fri, 13 Oct 2017 19:16:51 GMT

@cmerriman - a day... a week...Hey, to God it's a thousand years anyway, right?

I also notice that what the OP posted, his "yesterday" search ended at the hour cutoff beforen 24 secondws ago.