topic Re: Tweaking xyseries in Splunk Search

Tweaking xyseries

bmer — Fri, 18 Oct 2024 09:21:14 GMT

Iam using splunk to generate as below.It is run for 2 days date range where am trying to compare the count

ClassName	16-Oct-24	17-Oct-24
ClassA	544	489
ClassB	39	47
ClassC	1937	2100

My splunk query is as under

index=myindex RecordType=abc ClassName IN ( "ClassA", "ClassB", "ClassC") | bucket _time span=1d | stats avg(cpuTime) as avgCpuTime by ClassName _time | xyseries ClassName _time avgCpuTime

I need below output which has an extra column that gives the comparision.How can we tweak this query?Is there another way to achieve this in more visually appealing manner

ClassName	16-Oct-24	17-Oct-24	%Reduction
ClassA	544	489	10%
ClassB	39	47	-21%
ClassC	1937	2100	-8%

Re: Tweaking xyseries

ITWhisperer — Fri, 18 Oct 2024 10:02:32 GMT

index=myindex RecordType=abc ClassName IN ( "ClassA", "ClassB", "ClassC") | bucket _time span=1d | stats avg(cpuTime) as avgCpuTime by ClassName _time | xyseries ClassName _time avgCpuTime | eval "%Reduction"=round(100*('16-Oct-24'-'17-Oct-24')/'16-Oct-24',0)

Re: Tweaking xyseries

bmer — Fri, 18 Oct 2024 13:23:57 GMT

@ITWhisperer Thanks. This was helpful.I tweaked it to include more aggregate function