Splunk Search

Compare set of data from different times

karche
Path Finder

I have the following query to capture the application response time, and put it in summary index
source=iislog app="abc" | sistats avg(time_taken) count by source
index=summary search_name="capture app response time" | timechart span=1d avg(time_taken) by orig_source.

I would like to create a report that i can compare the response time for this week, last week and 4 weeks ago in the same report. How can i do that?

Thanks in advance.

Tags (1)
1 Solution

carasso
Splunk Employee
Splunk Employee

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.

I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.

... | timechart count span=1h | timewrap w

That's it!

http://apps.splunk.com/app/1645/

View solution in original post

carasso
Splunk Employee
Splunk Employee

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.

I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.

... | timechart count span=1h | timewrap w

That's it!

http://apps.splunk.com/app/1645/

RicoSuave
Builder

The easiest way to do this is by bucketing your _time field and then charting over it. Try this

index=summary search_name="capture app response time" | bucket _time span=1w | chart avg(time_taken) over _time by orig_source

This should produce a nice table with weekly averages. Run this over a month period and it should show what you are looking for.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...