Dashboards & Visualizations

Comparing data on two sets obtained from two different date ranges?

m_vivek
Path Finder

My data looks something like this
C1 C2 C3 C4 date
1 2 3 4 xx-xx-xxxx
3 4 3 1 xx-xx-xxxx
5 6 7 6 xx-xx-xxxx

C1 C2 C3 C4 date
4 5 3 4 yy-yy-yyyy
2 4 6 1 yy-yy-yyyy
7 4 7 0 yy-yy-yyyy

I am to extract this data from two different dates and compare their means etc.
How should I proceed ?
Any suggestions are welcome.

What I want to do :
Extract data from both dates in a single query
compare means on each column in both sets
display output in the form of a range map or a tabset icon inline.

Tags (3)

m_vivek
Path Finder

Getting both sets of results based on the choice of dates in a single query is
how far I have got till now. take a look.

index=abcd host=pqrs*   earliest=07/01/2015:00:0:0 latest=07/02/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE | eval dataset=1 | append[index=abcd host=pqrs*   earliest=07/03/2015:00:0:0 latest=07/04/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE  | eval dataset=2]

abcd pqrs are just for an idea.

My next step is to calculate means of each field/column for the corresponding data set and compare the means and output the results of the comparison in the form of a rangemap or tabset icon(inline).

Any suggestions/recommendations are welcome.
Thanks

0 Karma

jensonthottian
Contributor

If I am correct you have two time ranges to be compared in one report-

-http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/

Use date format instead of relative time.

m_vivek
Path Finder

Thank you for that @jensonthottian.
But,

I have about 180 items/fields that are being measured. I need to do a statistical analysis on each of the 180 fields/entities and then compare them over the time ranges.

How should I proceed in this case?

0 Karma

masonmorales
Influencer

Take a look at the Timewrap app: https://splunkbase.splunk.com/app/1645/

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...