Dashboards & Visualizations

How to plot data for two different time ranges in the same visualization?

mrncst
Engager

Hello, word!

I've started with Splunk a few days ago and still have a lot of questions.

I'd like to plot on the same graphic two different date ranges for the same metric (count by id). My aim is to compare two different scenarios around the same data (represented by an id), before and after a ux change in the website. Can you please help me?

0 Karma

landen99
Motivator

Here is a much more elegant solution which can plot all days on the same day in timechart:

| eval series=strftime(_time, "%m-%d") | eval time_delta=(now-_time)/86400,time_day=ceiling(time_delta),_time=_time+time_day*86400 | eval day=case(time_day=0,"Today",time_day=1,"Yesterday",time_day=8,"SD last week") | timechart fixedrange=false sum(count) by day

This allows you to plot any time range by series or to assign nice names in the case statement to each day based on its relation to the current time/day. 86400 is the number of seconds in a day.

0 Karma

Raghav2384
Motivator

Hey There,

there are tons of posts on how to achieve this functionality.

http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/ by Jon Webster

There is an app called Time Wrap in the splunk app base. Hope this will walk you in the right direction.

Thanks,
Raghav

mrncst
Engager

Thank you for your time!

I'm following the post instructions and my search displays a visualization but the lines aren't superimposed:

My search query:

index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-2d@d latest=-1d@d | eval ReportKey="today" | append [search index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-4d@d latest=-3d@d | eval ReportKey="yesterday"| eval _time=_time+60*60*24] | timechart span=10m count(id) by ReportKey

0 Karma

Raghav2384
Motivator

Please accept as answer / leave comments so that it would be easier for others to see the post.

Thanks,
Raghav

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The time difference between two searches is 2 days. Update your time adjustment to 2 days

| eval _time =  _time + 2*86400
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...