Currently I've got a report that runs and compares the download time values for the last hour and the same hour in the previous day:
Page Response Previous Day
Cart 0.15 0.13
Homepage 0.14 0.17
Nav 0.26 0.27
Product 0.37 0.32
I've got a query easy enough that will give me the current time - but I'm not sure how to get yesterdays during the same hour.
Here is my query:
index=omg test_name="Base Homepage" OR test_name="Base Storepage - Furniture" OR test_name="Base Product page - Memory Foam" OR test_name="Base Navigation page - Rugs" OR test_name="Base Cart Page" entry_type="Overall" | chart avg(response_time) as Response by test_name | eval Response=Response/1000 | eval Response=round(Response,2) | rename test_name as Page
Which returns in Splunk:
Page Response
Base Cart Page 0.13
Base Homepage 0.14
Base Navigation page - Rugs 0.24
Base Product page - Memory Foam 0.31
Base Storepage - Furniture 0.32
How can I also query a specific hour from another day? I found one question/answer that kind of addressed this - but it was for dates today and yesterday (whole days).
I would probably run the search this way:
index=omg earliest=-1h latest=now
test_name="Base Homepage" OR
test_name="Base Storepage - Furniture" OR
test_name="Base Product page - Memory Foam" OR
test_name="Base Navigation page - Rugs" OR
test_name="Base Cart Page" entry_type="Overall"
| chart avg(response_time) as Response by test_name
| eval Response=Response/1000
| eval Response=round(Response,2)
| rename test_name as Page
| join Page
[ search index=omg earliest=-24h latest=-23h
test_name="Base Homepage" OR
test_name="Base Storepage - Furniture" OR
test_name="Base Product page - Memory Foam" OR
test_name="Base Navigation page - Rugs" OR
test_name="Base Cart Page" entry_type="Overall"
| chart avg(response_time) as Response by test_name
| eval Response=Response/1000
| eval Response=round(Response,2)
| rename test_name as Page
| rename Response as "Previous Response"
]
There is quite possibly a more efficient way of running this, but given that they're two non-overlapping time windows, I'd imagine this would probably work.
I would probably run the search this way:
index=omg earliest=-1h latest=now
test_name="Base Homepage" OR
test_name="Base Storepage - Furniture" OR
test_name="Base Product page - Memory Foam" OR
test_name="Base Navigation page - Rugs" OR
test_name="Base Cart Page" entry_type="Overall"
| chart avg(response_time) as Response by test_name
| eval Response=Response/1000
| eval Response=round(Response,2)
| rename test_name as Page
| join Page
[ search index=omg earliest=-24h latest=-23h
test_name="Base Homepage" OR
test_name="Base Storepage - Furniture" OR
test_name="Base Product page - Memory Foam" OR
test_name="Base Navigation page - Rugs" OR
test_name="Base Cart Page" entry_type="Overall"
| chart avg(response_time) as Response by test_name
| eval Response=Response/1000
| eval Response=round(Response,2)
| rename test_name as Page
| rename Response as "Previous Response"
]
There is quite possibly a more efficient way of running this, but given that they're two non-overlapping time windows, I'd imagine this would probably work.
That did it. Thanks!