Dashboards & Visualizations

How to plot data for two different time ranges in the same visualization?

Engager

Hello, word!

I've started with Splunk a few days ago and still have a lot of questions.

I'd like to plot on the same graphic two different date ranges for the same metric (count by id). My aim is to compare two different scenarios around the same data (represented by an id), before and after a ux change in the website. Can you please help me?

0 Karma

Motivator

Here is a much more elegant solution which can plot all days on the same day in timechart:

| eval series=strftime(_time, "%m-%d") | eval time_delta=(now-_time)/86400,time_day=ceiling(time_delta),_time=_time+time_day*86400 | eval day=case(time_day=0,"Today",time_day=1,"Yesterday",time_day=8,"SD last week") | timechart fixedrange=false sum(count) by day

This allows you to plot any time range by series or to assign nice names in the case statement to each day based on its relation to the current time/day. 86400 is the number of seconds in a day.

0 Karma

Motivator

Hey There,

there are tons of posts on how to achieve this functionality.

http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/ by Jon Webster

There is an app called Time Wrap in the splunk app base. Hope this will walk you in the right direction.

Thanks,
Raghav

Engager

Thank you for your time!

I'm following the post instructions and my search displays a visualization but the lines aren't superimposed:

My search query:

index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-2d@d latest=-1d@d | eval ReportKey="today" | append [search index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-4d@d latest=-3d@d | eval ReportKey="yesterday"| eval _time=_time+60*60*24] | timechart span=10m count(id) by ReportKey

0 Karma

Motivator

Please accept as answer / leave comments so that it would be easier for others to see the post.

Thanks,
Raghav

0 Karma

SplunkTrust
SplunkTrust

The time difference between two searches is 2 days. Update your time adjustment to 2 days

| eval _time =  _time + 2*86400
0 Karma