The problem is that if I run the search at say 11:35, I get results for the 15 minute segments 11:00-11:15, 11:15-11:30, and 11:30-11:45. The trend compares the most recent two blocks, but since the last block isn't complete (it's only 11:35 and my range is from 11:30-11:45), the trend analysis is off.
How can I get the span to bucket the results so that they are relative to now? i.e if I run my search at 11:35, how can I get my results to be in buckets from 11:05-11:20 and 11:20-11:35 so that I have two equal sized buckets for trend comparison?
Hi,I had a situation to your issue and found a way to resolve what I needed.
I wanted to flag the amount of errors that occured in the past week within certain categories that exceeded 100. I wanted to compare this weeks number to last weeks number. The number is chosen based off of a time range picker used by the product owner at the top.
index="your_search" |eval early=$timerange.latest$-604800| eval late=$timerange.latest$ |where _time > early AND _time< late| | stats SUM(SQLERR_CNT) as Total by PGM_NM SSID _time | where Total > 100 |stats count AS 1Week | appendcols [search index="your_search" |eval early=$timerange.latest$-604800*2| eval late=$timerange.latest$ |where _time > early AND _time< late| | stats SUM(SQLERR_CNT) as Total by PGM_NM SSID _time | where Total > 100 |stats count AS 2Week]
by creating an early time used the time range token and subtracting the epoch time of the bucket. 604800 is the epoch time for 1 week. Then I appended a second search where I made the earliest time two weeks ago. and the latest time one week ago.
As far as putting this trend into a single value visualization. I have found the difference between the two numbers. and then displayed that number as a single value. Green if errors went down, red if they went up drastically! I am still working on how to best visually display my info.