Splunk Search

Compare two different values from two different periods

exocore123
Path Finder

I saw a few examples

https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-search-results-from-two-different-tim...

https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-time-same-time-frames-with-differen...

But these queries arent exact doing what I want to do. I basically want to do a 10min interval from now to 10 minutes ago. And compare it against the value from -24h and -24h (and 10 minutes before that) to do a comparison between the values. Whether it is in day to day trend for that 10min period

 

 

 

 

index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-24h latest=-1h
| eval period=if(_time>=relative_time(now(),"-23h"),"current","previous")  | chart count(request) over request by period  | eval difference=abs(previous-current)/previous*100 | table request difference previous current

 

 

Does anyone has an idea?

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Why don't you just set your initial search to capture the two periods of data like this

(index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-1450m latest=-1440m) OR
(index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-10m latest=now)
| eval period=if(_time>=relative_time(now(),"-23h"),"current","previous")
| chart count(request) over request by period
| eval difference=abs(previous-current)/previous*100
| table request difference previous current

The rest of your search is fine.

 

0 Karma

exocore123
Path Finder

Actually I think I solved it

index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h | stats count AS previous by request | appendcols [search index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now | stats count AS current by request] | eval difference=abs(previous-current)/previous*100
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@exocore123 

Using appendcols will not be as fast as using a single search and also you have to be totally sure that the requests from the previous time period all exist in the current time period otherwise your appendcols will generate the counts out of sync, so the rows won't match.

(index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h) OR
(index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now)

 Use this as your single search and then do your previous logic. 

0 Karma

exocore123
Path Finder

Good point - I dont know why I didnt think of that - I'll try this

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...