Splunk Search

Compare search results from two different timeframes

Paul82
New Member

I imagine what I'm trying to do is fairly simple, but I don't know how to do it.

I need to search our logs through two different timeframes and compare the results.

So for example if I search from 6 am through 9 am, and also search 5 pm through 8 pm for the term "error", can I have them compare the differences in percentages or have some kind of indication as to what errors are occurring more than others (or if there are errors happening in one time frame but not the other, etc)

Thanks to any/all in advance!

Tags (1)
0 Karma
1 Solution

chris
Motivator

This search compares the error rate of the 1st and the 3rd hour looking back 3h (you will obviously have to adapt the search terms of the base search to fit your environment):

index=* error  earliest=-3h | addinfo | stats count(eval(_time < (info_min_time + 3600 ))) as window1 count(eval(_time > (info_min_time +7200))) as window2 | eval Perc=round(window1/window2*100,2)

To compare the errors that occur they have to be in a field. If the field is called errorType then the following search would show the percentage per error:

index=* error  earliest=-3h | addinfo | stats count(eval(_time < (info_min_time + 3600 ))) as window1 count(eval(_time > (info_min_time +7200))) as window2 by errorType | eval Perc=round(window1/window2*100,2)

Does this help?

Chris

View solution in original post

chris
Motivator

This search compares the error rate of the 1st and the 3rd hour looking back 3h (you will obviously have to adapt the search terms of the base search to fit your environment):

index=* error  earliest=-3h | addinfo | stats count(eval(_time < (info_min_time + 3600 ))) as window1 count(eval(_time > (info_min_time +7200))) as window2 | eval Perc=round(window1/window2*100,2)

To compare the errors that occur they have to be in a field. If the field is called errorType then the following search would show the percentage per error:

index=* error  earliest=-3h | addinfo | stats count(eval(_time < (info_min_time + 3600 ))) as window1 count(eval(_time > (info_min_time +7200))) as window2 by errorType | eval Perc=round(window1/window2*100,2)

Does this help?

Chris

MuS
SplunkTrust
SplunkTrust

small addition to this great answer: take a look at the timewrap app https://apps.splunk.com/app/1645/

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...