Splunk Search

Comparing two searches from separate time ranges while still having a clean chart

bencooper1
Engager

Hello,

I am trying to compare two time windows in the same index but I would like the chart comparing them to be based on a specified name of those time ranges rather than on time.

For example:

Release_A = October 2nd
Release_B = September 20th

(index=.... url=* earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url=* earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d

I want the chart x-axis values to be Release_A and Release_B rather than a timeline.
Any advice on how to do this would be very appreciated.

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

OR

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

View solution in original post

mayurr98
Super Champion

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

OR

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

bencooper1
Engager

That helped a lot and I will definitely be using that eval-case command in the future.
Thank you!

0 Karma

to4kawa
Ultra Champion
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/03/2019:00:00:00") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/21/2019:00:00:00")
| timechart avg(seconds)  span=1d

Hi, try timechart

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...