topic Re: How to overlay two graphs with different time ranges in Splunk Search

How to overlay two graphs with different time ranges

OctoberP — Wed, 25 Aug 2021 13:18:51 GMT

Would you know how can I display an overlay of two charts that have different time ranges on the X-axis?
For example, I would like to compare CPU utilization yesterday with the CPU utilization a week ago.

Is it possible to combine the results of two searches below into one chart?
| mstats avg(cpu.pctIdle) AS cpu_idle_pct WHERE index=mymetrics host=myserver span=5min earliest=-2days latest=-1days | timechart min(cpu_idle_pct) span=1hour
| mstats avg(cpu.pctIdle) AS cpu_idle_pct WHERE index=mymetrics host=myserver span=5min earliest=-9days latest=-8days | timechart min(cpu_idle_pct) span=1hour

Thanks !

Re: How to overlay two graphs with different time ranges

nyc_jason — Sat, 28 Aug 2021 00:42:13 GMT

Hello, please have a look at the timewrap command. https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Timewrap?ref=hk

This may be what youre looking for.

Re: How to overlay two graphs with different time ranges

ITWhisperer — Sat, 28 Aug 2021 09:03:24 GMT

Calculate the hour from the _time variable and use that as your common x-axis

Re: How to overlay two graphs with different time ranges

eddieddieddie — Mon, 30 Aug 2021 00:02:07 GMT

Hi OctoberP

As suggested the timewrap command should help. The trick here is just showing the two days you're interesting in and not everthing else inbetween (otherwise when it's graphed you have a long empty stretch).

I came up with the following which gets the data for the complete time period where the two days you're interested in overlap, and then time wraps it by a week ('w') so that the two days will overlap when plotted on a graph. The results are then cropped by the where command on the last line to just show the day you're interested in.

| mstats avg(Processor.%_Processor_Time) AS CPUUsage WHERE index=mymetrics host=myserver span=5min earliest=-9days@d latest=-1days@d | timechart span=1h avg(CPUUsage) AS "CPUUsage" | timewrap w | where strftime(_time, "%A") == strftime( relative_time(now(), "-2days@d") ,"%A" )

Re: How to overlay two graphs with different time ranges

OctoberP — Mon, 30 Aug 2021 14:06:16 GMT

Thank you! The approach with 'timewrap' command worked perfectly for me.

Re: How to overlay two graphs with different time ranges

OctoberP — Mon, 30 Aug 2021 14:07:23 GMT

Thank you! The approach with 'timewrap' command worked perfectly for me.