Splunk Search

Comparing two searches from separate time ranges while still having a clean chart

bencooper1
Engager

Hello,

I am trying to compare two time windows in the same index but I would like the chart comparing them to be based on a specified name of those time ranges rather than on time.

For example:

Release_A = October 2nd
Release_B = September 20th

(index=.... url=* earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url=* earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d

I want the chart x-axis values to be Release_A and Release_B rather than a timeline.
Any advice on how to do this would be very appreciated.

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

OR

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

View solution in original post

mayurr98
Super Champion

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

OR

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

bencooper1
Engager

That helped a lot and I will definitely be using that eval-case command in the future.
Thank you!

0 Karma

to4kawa
Ultra Champion
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/03/2019:00:00:00") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/21/2019:00:00:00")
| timechart avg(seconds)  span=1d

Hi, try timechart

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...