https://community.splunk.com/t5/Splunk-Search/Compare-set-of-data-from-different-times/m-p/92612#M182371 <P>The easiest way to do this is by bucketing your _time field and then charting over it. Try this</P> <PRE><CODE>index=summary search_name="capture app response time" | bucket _time span=1w | chart avg(time_taken) over _time by orig_source </CODE></PRE> <P>This should produce a nice table with weekly averages. Run this over a month period and it should show what you are looking for. </P> Mon, 17 Oct 2011 12:43:49 GMT RicoSuave 2011-10-17T12:43:49Z https://community.splunk.com/t5/Splunk-Search/Compare-set-of-data-from-different-times/m-p/92611#M182370 <P>I have the following query to capture the application response time, and put it in summary index<BR /> source=iislog app="abc" | sistats avg(time_taken) count by source<BR /> index=summary search_name="capture app response time" | timechart span=1d avg(time_taken) by orig_source. </P> <P>I would like to create a report that i can compare the response time for this week, last week and 4 weeks ago in the same report. How can i do that?</P> <P>Thanks in advance.</P> Mon, 28 Sep 2020 09:59:22 GMT https://community.splunk.com/t5/Splunk-Search/Compare-set-of-data-from-different-times/m-p/92611#M182370 karche 2020-09-28T09:59:22Z https://community.splunk.com/t5/Splunk-Search/Compare-set-of-data-from-different-times/m-p/92612#M182371 <P>The easiest way to do this is by bucketing your _time field and then charting over it. Try this</P> <PRE><CODE>index=summary search_name="capture app response time" | bucket _time span=1w | chart avg(time_taken) over _time by orig_source </CODE></PRE> <P>This should produce a nice table with weekly averages. Run this over a month period and it should show what you are looking for. </P> Mon, 17 Oct 2011 12:43:49 GMT https://community.splunk.com/t5/Splunk-Search/Compare-set-of-data-from-different-times/m-p/92612#M182371 RicoSuave 2011-10-17T12:43:49Z https://community.splunk.com/t5/Splunk-Search/Compare-set-of-data-from-different-times/m-p/92613#M182372 <P><STRONG>Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.</STRONG></P> <P>I wrote a convenient search command called "<A href="http://apps.splunk.com/app/1645/">timewrap</A>" that does it all, for arbitrary time periods.</P> <PRE><CODE>... | timechart count span=1h | timewrap w </CODE></PRE> <P>That's it!</P> <P><A href="http://apps.splunk.com/app/1645/">http://apps.splunk.com/app/1645/</A></P> Fri, 06 Dec 2013 21:28:42 GMT https://community.splunk.com/t5/Splunk-Search/Compare-set-of-data-from-different-times/m-p/92613#M182372 carasso 2013-12-06T21:28:42Z