Splunk Search

How can I compare latest stats with older metrics in a table?

New Member


I have application metrics in a log, and every 10 minutes, I'm printing all app perf stats. It looks like ():

2016-01-30 00:00:00.000 [metrics] name=readDatabase min=0.001 mean=0.005 p99=0.013 
2016-01-30 00:00:00.000 [metrics] name=writeDatabase min=0.003 mean=0.025 p99=0.442 
2016-01-30 00:00:00.000 [metrics] name=readCache min=0.0001 mean=0.0002 p99=0.001 
2016-01-30 00:00:00.000 [metrics] name=writeCache min=0.001 mean=0.005 p99=0.013 

Actually, there's much more metrics and much more stats for each them: all percentiles, error rates, etc.

I would like to turn it into a table, where metrics would be rows and stats would be columns, and I would like to have different aggregation for comparison, like compare last print out with average for the last 24h:

| name         | mean_last | p50_last | mean_avg24h | p50_avg24h |
| readDatabase | 0.005     | 0.001    | 0.03        | 0.02       | 
| writeDatabase| 0.010     | 0.005    | 0.015       | 0.020      | 

Is it possible?

0 Karma

Revered Legend

Try something like this

your base search | table _time name min mean p99 | stats latest(*) as *_last by name  | append [search your base search | table _time name min mean p99 | stats avg(*) as *_avg24h by name ] | stats values(*) as * by name
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!