Compare last hour values with previous day values (during that same hour).

[nocostk]

Currently I've got a report that runs and compares the download time values for the last hour and the same hour in the previous day:

Page       Response Previous Day
Cart       0.15     0.13    
Homepage   0.14  0.17       
Nav     0.26     0.27       
Product 0.37     0.32       

I've got a query easy enough that will give me the current time - but I'm not sure how to get yesterdays during the same hour.

Here is my query:

index=omg test_name="Base Homepage" OR test_name="Base Storepage - Furniture" OR test_name="Base Product page - Memory Foam" OR test_name="Base Navigation page - Rugs" OR test_name="Base Cart Page" entry_type="Overall" | chart avg(response_time) as Response by test_name | eval Response=Response/1000 | eval Response=round(Response,2) | rename test_name as Page

Which returns in Splunk:

Page                               Response
Base Cart Page                    0.13
Base Homepage                      0.14
Base Navigation page - Rugs      0.24
Base Product page - Memory Foam     0.31
Base Storepage - Furniture        0.32

How can I also query a specific hour from another day? I found one question/answer that kind of addressed this - but it was for dates today and yesterday (whole days).

[David · Accepted solution]

I would probably run the search this way:

index=omg earliest=-1h latest=now
   test_name="Base Homepage" OR 
   test_name="Base Storepage - Furniture" OR 
   test_name="Base Product page - Memory Foam" OR 
   test_name="Base Navigation page - Rugs" OR 
   test_name="Base Cart Page" entry_type="Overall" 
   | chart avg(response_time) as Response by test_name 
   | eval Response=Response/1000 
   | eval Response=round(Response,2) 
   | rename test_name as Page
   | join Page 
       [ search index=omg earliest=-24h latest=-23h
           test_name="Base Homepage" OR 
           test_name="Base Storepage - Furniture" OR 
           test_name="Base Product page - Memory Foam" OR 
           test_name="Base Navigation page - Rugs" OR 
           test_name="Base Cart Page" entry_type="Overall" 
           | chart avg(response_time) as Response by test_name 
           | eval Response=Response/1000 
           | eval Response=round(Response,2) 
           | rename test_name as Page
           | rename Response as "Previous Response"
       ]

There is quite possibly a more efficient way of running this, but given that they're two non-overlapping time windows, I'd imagine this would probably work.

[nocostk]

That did it. Thanks!