Splunk Search

How to compare average between two non-adjacent time periods?



what' the best way to compare averages between two non-adjacent time periods. I have bunch of api call events with response_time field. I need a dashboard, where I can see the performance difference between last month and current month.

If I try the following, somehow the averages are blank in dashboard, but click on the enlarging glass of the tile, I get a a search query with values. What am I missing?

Is there an even more efficient and faster way?



  <label>API Performance</label>
  <search id="multisearch">
    <query>| multisearch 
	[ search earliest=$periodBeforeTok.earliest$ latest=$periodBeforeTok.latest$  index=A my_search_query response_time=*
		| eval response_time_before=response_time
		| fields api_request response_time_before
		| eval timeSlot="1"  ]
	 [search earliest=$periodAfterTok.earliest$ latest=$periodAfterTok.latest$ index=A my_search_query
		| eval response_time_after=response_time
		| fields api_request response_time_after
		| eval timeSlot="2" ]
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="periodBeforeTok">
      <label>Before Time Period</label>
    <input type="time" token="periodAfterTok">
      <label>After Time Period</label>
        <title>Query Stats</title>
        <search base="multisearch">
          <query>| stats  count as totalCount, count(eval(timeSlot=1)) as totalCountBefore, count(eval(timeSlot=2)) as totalCountAfter, avg(response_time_before) as response_time_before, avg(response_time_after) as response_time_after by api_request
	| eval response_time_before=round(response_time_before/1000,3)
	| eval response_time_after=round(response_time_after/1000,3)
	| eval delta_response_time=response_time_after-response_time_before
	| table api_request totalCountBefore totalCountAfter response_time_before response_time_after delta_response_time</query>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>



Labels (1)
Tags (2)
0 Karma


Is this just a typo? Your multisearch has fields api_api_request whereas your stats has api_request

0 Karma


ouh yeah, you are right. That was a typo. I've fixed the type now. The questions stays the same.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...