topic Re: Wants to compare last 4 hours data with last 2 days data over the same time in Splunk Search

Wants to compare last 4 hours data with last 2 days data over the same time

Sishad — Tue, 13 Aug 2024 09:47:07 GMT

Hi Splunk experts,

I want to compare the response code of our API for last 4 hours with last 2 days data over the same time.
And if possible I would need results in a chart/table format where it shows the data as below.

<Reponse Codes | Last 4 Hours | Yesterday | Day before Yesterday>

As of now i am getting results in hours wise.
Can we achieve this one in Splunk ? Can you guys please guide me in the right direction to achieve this.

Re: Wants to compare last 4 hours data with last 2 days data over the same time

ITWhisperer — Tue, 13 Aug 2024 13:28:47 GMT

Start by changing the time period on your search to (earliest=now-4h latest=now) OR (earliest=-1d-4h latest=-1d) OR (earliest=-2d-4h latest=-2d)

Re: Wants to compare last 4 hours data with last 2 days data over the same time

Sishad — Tue, 13 Aug 2024 14:08:48 GMT

But I was looking to can show these 3 timeline values as a chart/table.
So that I can create a report on this and send out email to my team.
Can this be achieved ?

Re: Wants to compare last 4 hours data with last 2 days data over the same time

ITWhisperer — Tue, 13 Aug 2024 14:31:12 GMT

Yes, the timewrap command can take the output from a timechart to create multiple lines over the 4 hour period

Re: Wants to compare last 4 hours data with last 2 days data over the same time

Sishad — Wed, 14 Aug 2024 13:40:27 GMT

Thanks @ITWhisperer for your suggestion.😊

I was able to do produce the requested data via this command.