How create line chart showing the count for Current week, prior week and third week?

[SG]

Hi Team,

I am planning to draw the trend of the webpage test speed index trend in Splunk which gives the performance of the speed index for the current week, last week, and last before week. I developed the below query to do the job, but I am not getting the trend and query giving some error. Can someone please help me to draw the trend?

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| eval myTime=case(test >= relative_time(now(), "-7d"), "CurrentWeek", test >= relative_time(now(), "-14d") AND test < relative_time(now(), "-7d", "PriorWeek", test >= relative_time(now(), "-21d") AND test < relative_time(now(), "-14d", "ThirdWeek", 1=1, "Other")
| stats  values(speedindex) as score by myTime 
| eval fast = if(score>0 AND score<2000,score,0)  
| eval moderate = if(score>=2000 AND score<2999,score,0) 
| eval slow = if(score>=3000,score,0)
| fields - score

[ITWhisperer]

| stats  values(speedindex) as score by myTime 

This returns a multi-value field of all the unique scores in the time period. Is that what you were expecting?

[SG]

I modified the query to get speed index values as per the week 

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" earliest=-7d@d
| eval myTime=case(_time >= relative_time(now(), "-7d"), "CurrentWeek", _time >= relative_time(now(), "-14d") AND _time < relative_time(now(), "-7d"), "PriorWeek", _time >= relative_time(now(), "-21d") AND _time < relative_time(now(), "-14d"), "ThirdWeek", 1=1, "Other")
| stats  values(speedindex) as score by myTime

Now i am getting data in the statistics panel as below. 

But i am not getting any trend in the visualization panel.

[SG]

I got to know that "values" function is giving results as a string, that's the reason I am not getting any trend. 

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" earliest=-7d@d
| eval myTime=case(_time >= relative_time(now(), "-7d"), "CurrentWeek", _time >= relative_time(now(), "-14d") AND _time < relative_time(now(), "-7d"), "PriorWeek", _time >= relative_time(now(), "-21d") AND _time < relative_time(now(), "-14d"), "ThirdWeek", 1=1, "Other")
| stats  values(speedindex) as score by myTime

Can you please tell me instead of "values", which function i can use to get the trend?

[SG · Accepted solution]

I could get data week wise using "timewrap" function in splunk.

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" earliest=-21d@d | timechart span=1h list(speedindex) as score | timewrap w

Source - https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Timewrap