Splunk Search

How to compare results of a bar chart from two different times

nitingurram
New Member

I have a search
index=* sourcetype=tsv Transaction=* Jmeter_measure="ok.pct90"| chart avg(Jmeter_RT_val) by Transaction | rename avg(Jmeter_RT_val) AS "90%RT" |sort Transaction

alt text

which shows average response times of different transaction during a test in a bar chart format.

I want to compare results from two different time periods (Different tests) say between (10:30 09 July 2015 to 11:30 09 July 2015 ) and (12:30 08 July 2015 to 13:30 08 July 2015 ) so that I can see if there something taking longer time than before. I would prefer them to be in different colors.

0 Karma

woodcock
Esteemed Legend

This has been answered many times, just search for "Splunk timechart overlay". Any of these solutions should be workable:

http://answers.splunk.com/answers/122137/two-query-results-overlay-on-same-graph.html
http://answers.splunk.com/answers/12436/combine-searches-in-one-timechart.html
http://answers.splunk.com/answers/103229/timechart-overlay-multiple-strings.html

But in your case, you will have to add a time adjustment to one of your searches to have it "lie to Splunk" about when it happened so that the X-axis overlaps, just add the timeshift to the end of that search like this:

... | eval time=time+S0m3num83r
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...