topic Re: need to create over lapping dashboard in Splunk Search

How to create over lapping dashboard?

ssharma — Mon, 13 Feb 2023 17:12:18 GMT

I am new to slunk, I have to create one dashboard and compare current day with same day of last week based on request ids count.

index="test" s_name="test-app*" earliest=-0d@d latest=now | bucket span=1h _time | stats dc(message.req_id) as tcount by _time | eval ReportKey="today" | append [search index="test" s_name="test-app*" earliest=-7d@d latest=-6d@d | bucket span=1h _time | stats dc(message.req_id) as week by _time | eval ReportKey="lweek"] | timechart span=1h sum(week) as Lweek, sum(tcount) as Today by ReportKey

I want to create over lapping dashboard, like

Thanks in advance

Re: need to create over lapping dashboard

gcusello — Mon, 13 Feb 2023 11:11:49 GMT

Hi @ssharma,

please try something like this:

index="test" cf_app_name="test-app*" ((earliest=-0d@d latest=now) OR (earliest=-7d@d latest=-6d@d)) | eval hour=strftime(_time, "%H"), week=if(now()-_time>86400,"Previous week","This week") | chart dc(message.req_id) OVER hour BY week

Ciao.

Giuseppe

Re: need to create over lapping dashboard

ssharma — Mon, 13 Feb 2023 12:35:15 GMT

@gcusello
Is that possible to create chart based on _time ??

Re: need to create over lapping dashboard

gcusello — Mon, 13 Feb 2023 13:48:41 GMT

Hi @ssharma,

yes it's possible using timechart, but you want to overlap values of today's hours and one week ago, and this is one solution.

Ciao.

Giuseppe

Re: need to create over lapping dashboard

ssharma — Mon, 13 Feb 2023 14:16:01 GMT

Hi @gcusello

According to yr solution still I can see till 23 hour of yesterday in current week day but now its start new day,
can it possible to take current time to last 24 hours ??

Re: need to create over lapping dashboard

gcusello — Mon, 13 Feb 2023 14:14:04 GMT

Hi @ssharma ,

let me better understand: what time period do you want to monitor?

I used the time frames of your search, if you want a different time frame put it in the search parameters.

If you want the todays values, you could use:

index="test" cf_app_name="test-app*" ((earliest=@d latest=now) OR (earliest=-7d@d latest=-6d@d)) | eval hour=strftime(_time, "%H"), week=if(now()-_time>86400,"Previous week","This week") | chart dc(message.req_id) OVER hour BY week

Ciao.

Giuseppe