Splunk Search

Compare two different values from two different periods

exocore123
Path Finder

I saw a few examples

https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-search-results-from-two-different-tim...

https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-time-same-time-frames-with-differen...

But these queries arent exact doing what I want to do. I basically want to do a 10min interval from now to 10 minutes ago. And compare it against the value from -24h and -24h (and 10 minutes before that) to do a comparison between the values. Whether it is in day to day trend for that 10min period

 

 

 

 

index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-24h latest=-1h
| eval period=if(_time>=relative_time(now(),"-23h"),"current","previous")  | chart count(request) over request by period  | eval difference=abs(previous-current)/previous*100 | table request difference previous current

 

 

Does anyone has an idea?

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Why don't you just set your initial search to capture the two periods of data like this

(index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-1450m latest=-1440m) OR
(index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-10m latest=now)
| eval period=if(_time>=relative_time(now(),"-23h"),"current","previous")
| chart count(request) over request by period
| eval difference=abs(previous-current)/previous*100
| table request difference previous current

The rest of your search is fine.

 

0 Karma

exocore123
Path Finder

Actually I think I solved it

index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h | stats count AS previous by request | appendcols [search index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now | stats count AS current by request] | eval difference=abs(previous-current)/previous*100
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@exocore123 

Using appendcols will not be as fast as using a single search and also you have to be totally sure that the requests from the previous time period all exist in the current time period otherwise your appendcols will generate the counts out of sync, so the rows won't match.

(index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h) OR
(index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now)

 Use this as your single search and then do your previous logic. 

0 Karma

exocore123
Path Finder

Good point - I dont know why I didnt think of that - I'll try this

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!