https://community.splunk.com/t5/Splunk-Search/Compare-Results-for-2-different-time-frames/m-p/661256#M228295 <P>Want to compare Dynatrace results (Total calls &amp; Avg/90% responses times) for current week Vs Last week. And need to display the differences.&nbsp;</P> <P>Sample Query:&nbsp;</P> <LI-CODE lang="markup">index="dynatrace" sourcetype="dynatrace:usersession" | spath output=pp_user_action_user path=userId | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="xxxxxxx" | spath output=pp_key_user_action input=user_actions path=keyUserAction | where pp_key_user_action="true"| spath output=pp_user_action_name input=user_actions path=name | spath output=pp_user_action_response input=user_actions path=visuallyCompleteTime | eval pp_user_action_name=substr(pp_user_action_name,0,150) | eventstats avg(pp_user_action_response) AS "Avg_User_Action_Response" by pp_user_action_name | stats count(pp_user_action_response) As "Total_Calls",perc90(pp_user_action_response) AS "Perc90_User_Action_Response" by pp_user_action_name Avg_User_Action_Response | eval Perc90_User_Action_Response=round(Perc90_User_Action_Response,0)/1000| eval Avg_User_Action_Response=round(Avg_User_Action_Response,0)/1000 | table pp_user_action_name,Total_Calls,Avg_User_Action_Response,Perc90_User_Action_Response | sort -Perc90_User_Action_Response</LI-CODE> Thu, 19 Oct 2023 11:56:56 GMT sabari80 2023-10-19T11:56:56Z https://community.splunk.com/t5/Splunk-Search/Compare-Results-for-2-different-time-frames/m-p/661256#M228295 <P>Want to compare Dynatrace results (Total calls &amp; Avg/90% responses times) for current week Vs Last week. And need to display the differences.&nbsp;</P> <P>Sample Query:&nbsp;</P> <LI-CODE lang="markup">index="dynatrace" sourcetype="dynatrace:usersession" | spath output=pp_user_action_user path=userId | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="xxxxxxx" | spath output=pp_key_user_action input=user_actions path=keyUserAction | where pp_key_user_action="true"| spath output=pp_user_action_name input=user_actions path=name | spath output=pp_user_action_response input=user_actions path=visuallyCompleteTime | eval pp_user_action_name=substr(pp_user_action_name,0,150) | eventstats avg(pp_user_action_response) AS "Avg_User_Action_Response" by pp_user_action_name | stats count(pp_user_action_response) As "Total_Calls",perc90(pp_user_action_response) AS "Perc90_User_Action_Response" by pp_user_action_name Avg_User_Action_Response | eval Perc90_User_Action_Response=round(Perc90_User_Action_Response,0)/1000| eval Avg_User_Action_Response=round(Avg_User_Action_Response,0)/1000 | table pp_user_action_name,Total_Calls,Avg_User_Action_Response,Perc90_User_Action_Response | sort -Perc90_User_Action_Response</LI-CODE> Thu, 19 Oct 2023 11:56:56 GMT https://community.splunk.com/t5/Splunk-Search/Compare-Results-for-2-different-time-frames/m-p/661256#M228295 sabari80 2023-10-19T11:56:56Z https://community.splunk.com/t5/Splunk-Search/Compare-Results-for-2-different-time-frames/m-p/661259#M228298 <P>Pro tip: Instead of asking volunteers to reverse engineer complex codes and screenshots without explanation, it is much more productive to post sample/mock data in text (anonymize as needed), illustrate desired results in text, and explain the logic between data and desired results. &nbsp;Post (pseudo) codes only if they help explanation; if posted code does not give desired results, also illustrate actual results or error message in text.</P> Wed, 18 Oct 2023 18:48:31 GMT https://community.splunk.com/t5/Splunk-Search/Compare-Results-for-2-different-time-frames/m-p/661259#M228298 yuanliu 2023-10-18T18:48:31Z