topic Re: Query for comparing 2 different time periods in Splunk Search

Query for comparing 2 different time periods

WeiMar — Thu, 19 Sep 2024 12:37:35 GMT

Hi together,
I try to compare the PERC90 response times of an application before and after a software release for the 50 most used actions.

Here's the query

index=myindex source=mysource 
| rex field=_raw "^(?:[^;\n]*;){4}\s+(?P<utc_tsl_tranid>\w+:\w+)" 
| rex field=_raw "^.+\/(?P<ui_locend>\w+\.[a-z_-]+\.\w+\.\w+)" 
| dedup utc_tsl_tranid 
| stats sum(DURATION) as weight by ui_locend 
| sort - weight | head 50

Is there a way I can compare 2 time periods (for example: first start 2024-08-10 end 2024-08-15, second start 2024-08-20 end 2024-08-25).

Field ui_locend has to match and I like to compare PERC(90) of DURATION, which can be calculated with STATS-Command.

It's a tricky one, will appreciate every idea.

Re: Query for comparing 2 different time periods

ITWhisperer — Thu, 19 Sep 2024 12:54:38 GMT

Change the time period of your search to include both time periods e.g. (earliest=<start of first period> latest=<end of first period>) OR (earliest=<start of second period> latest=<end of second period>). Then evaluate which period the event falls into eval period=if(_time < end of first period, "first", "second"). Then add period to you by clause.

Re: Query for comparing 2 different time periods

WeiMar — Thu, 19 Sep 2024 14:38:07 GMT

That was quick, thank you!

I always struggle a little bit with the date formats. Which formats are accepted in den <periods>-fields or what do I have to do, that format yyyy-mm-dd (without time) is possible?