Dynamic Baseline for Timechart

tpederson — Wed, 21 Aug 2013 21:41:59 GMT

I need help building a chart that has a dynamic baseline based on the last 30 days of data. Over that baseline, I would put values from the last ten days.

I dont have the karma to post the mock-up image I made, but I can try to represent the data I would like in a table.

        avg(Elapsed)    perc90(elapsed) 30dAvgElapsed   30dPerc90Elapsed
1-Aug       0.19        0.22        0.22        0.25
2-Aug       0.35        0.38        0.22        0.25
3-Aug       0.27        0.30        0.22        0.25
4-Aug       0.22        0.25        0.22        0.25
5-Aug       0.18        0.21        0.22        0.25
6-Aug       0.21        0.24        0.22        0.25
7-Aug       0.25        0.28        0.22        0.25
8-Aug       0.32        0.35        0.22        0.25
9-Aug       0.11        0.14        0.22        0.25
10-Aug      0.10        0.13        0.22        0.25

So, the avg(elapsed) and perc90(elapsed) would be variable, but the 30d avg and perc90 would be straight lines on a line chart. This would let me see if our times in the last ten days were deviating significantly from our numbers in the last 30 days.

I tried to use appendcols and a subsearch for the 30 day numbers. But, I couldn't get the same numbers to fill those columns and make a baseline across the chart.

How is this done?

Re: Dynamic Baseline for Timechart

HiroshiSatoh — Thu, 22 Aug 2013 00:33:00 GMT

But what about such a feeling? Please adjust the fine format.

(ex.)
index=* earliest=-30d@d latest=@d|eval Day=strftime(_time,"%Y-%m-%d")|stats avg(elapsed) as avg(Elapsed), perc90(elapsed) as perc90(elapsed) by Day|eval ID=1|join ID [search index=* earliest=-30d@d latest=@d |stats avg(elapsed) as 30dAvgElapsed, perc90(elapsed) as 30dPerc90Elapsed|eval ID=1]

topic Re: Dynamic Baseline for Timechart in Splunk Search

Dynamic Baseline for Timechart

Re: Dynamic Baseline for Timechart