Compare search results from two different timeframes

[Paul82]

I imagine what I'm trying to do is fairly simple, but I don't know how to do it.

I need to search our logs through two different timeframes and compare the results.

So for example if I search from 6 am through 9 am, and also search 5 pm through 8 pm for the term "error", can I have them compare the differences in percentages or have some kind of indication as to what errors are occurring more than others (or if there are errors happening in one time frame but not the other, etc)

Thanks to any/all in advance!

[chris · Accepted solution]

This search compares the error rate of the 1st and the 3rd hour looking back 3h (you will obviously have to adapt the search terms of the base search to fit your environment):

index=* error  earliest=-3h | addinfo | stats count(eval(_time < (info_min_time + 3600 ))) as window1 count(eval(_time > (info_min_time +7200))) as window2 | eval Perc=round(window1/window2*100,2)

To compare the errors that occur they have to be in a field. If the field is called errorType then the following search would show the percentage per error:

index=* error  earliest=-3h | addinfo | stats count(eval(_time < (info_min_time + 3600 ))) as window1 count(eval(_time > (info_min_time +7200))) as window2 by errorType | eval Perc=round(window1/window2*100,2)

Does this help?

Chris

[MuS]

small addition to this great answer: take a look at the timewrap app https://apps.splunk.com/app/1645/