Splunk Search

Comparing two searches from separate time ranges while still having a clean chart

bencooper1
Engager

Hello,

I am trying to compare two time windows in the same index but I would like the chart comparing them to be based on a specified name of those time ranges rather than on time.

For example:

Release_A = October 2nd
Release_B = September 20th

(index=.... url=* earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url=* earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d

I want the chart x-axis values to be Release_A and Release_B rather than a timeline.
Any advice on how to do this would be very appreciated.

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

OR

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

View solution in original post

mayurr98
Super Champion

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

OR

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

bencooper1
Engager

That helped a lot and I will definitely be using that eval-case command in the future.
Thank you!

0 Karma

to4kawa
Ultra Champion
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/03/2019:00:00:00") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/21/2019:00:00:00")
| timechart avg(seconds)  span=1d

Hi, try timechart

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...