How to compare today vs last week same hour stats and give percentage?

DougiieDee — Thu, 23 Mar 2023 14:35:32 GMT

I have this working query which needs some additional detailing.

index=_internal earliest=-1h@h latest=@h
| lookup api uri OUTPUT operation service
| rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="Today"
| append
[ search index=_internal earliest=-7d-1h@h latest=-7d@h
| lookup api uri OUTPUT operation service
| rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="lastweek" | eval _time=_time+604800]
| stats first(uri) as apiName avg(response_time) as avgresponse_time count by operationName ReportKey

Is there a way to get like this where it will compare all average response time and then give the percentile differences.

operation

uri

today_avg

(response_time)

lastweek_avg

(response_time)

% differrences

avg(response_time)

today

count

last week

count

abc

/api/abc

222

333

12312

42343

xyz

/api/xyz

867

4234

87978

67867

Re: compare today vs last week same hour stats and give percentage

yeahnah — Thu, 23 Mar 2023 03:15:43 GMT

Hi @DougiieDee

This same question has also been asked and anwsered here

https://community.splunk.com/t5/Splunk-Search/How-to-compare-today-hourly-stats-and-previous-week-same-day/td-p/635389/jump-to/first-unread-message

topic How to compare today vs last week same hour stats and give percentage? in Splunk Search

How to compare today vs last week same hour stats and give percentage?

Re: compare today vs last week same hour stats and give percentage