topic Re: Comparing two searches from separate time ranges while still having a clean chart in Splunk Search

Comparing two searches from separate time ranges while still having a clean chart

bencooper1 — Wed, 30 Sep 2020 02:47:50 GMT

Hello,

I am trying to compare two time windows in the same index but I would like the chart comparing them to be based on a specified name of those time ranges rather than on time.

For example:

Release_A = October 2nd
Release_B = September 20th

(index=.... url=* earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url=* earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d

I want the chart x-axis values to be Release_A and Release_B rather than a timeline.
Any advice on how to do this would be very appreciated.

Re: Comparing two searches from separate time ranges while still having a clean chart

to4kawa — Fri, 01 Nov 2019 20:34:09 GMT

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/03/2019:00:00:00") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/21/2019:00:00:00")
| timechart avg(seconds)  span=1d

Hi, try timechart

Re: Comparing two searches from separate time ranges while still having a clean chart

mayurr98 — Fri, 01 Nov 2019 20:59:27 GMT

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

Re: Comparing two searches from separate time ranges while still having a clean chart

bencooper1 — Mon, 04 Nov 2019 16:25:33 GMT

That helped a lot and I will definitely be using that eval-case command in the future.
Thank you!