Splunk Search

How to compare results of a bar chart from two different times

nitingurram
New Member

I have a search
index=* sourcetype=tsv Transaction=* Jmeter_measure="ok.pct90"| chart avg(Jmeter_RT_val) by Transaction | rename avg(Jmeter_RT_val) AS "90%RT" |sort Transaction

alt text

which shows average response times of different transaction during a test in a bar chart format.

I want to compare results from two different time periods (Different tests) say between (10:30 09 July 2015 to 11:30 09 July 2015 ) and (12:30 08 July 2015 to 13:30 08 July 2015 ) so that I can see if there something taking longer time than before. I would prefer them to be in different colors.

0 Karma

woodcock
Esteemed Legend

This has been answered many times, just search for "Splunk timechart overlay". Any of these solutions should be workable:

http://answers.splunk.com/answers/122137/two-query-results-overlay-on-same-graph.html
http://answers.splunk.com/answers/12436/combine-searches-in-one-timechart.html
http://answers.splunk.com/answers/103229/timechart-overlay-multiple-strings.html

But in your case, you will have to add a time adjustment to one of your searches to have it "lie to Splunk" about when it happened so that the X-axis overlaps, just add the timeshift to the end of that search like this:

... | eval time=time+S0m3num83r
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...