Splunk Search

How to compare results of a bar chart from two different times

nitingurram
New Member

I have a search
index=* sourcetype=tsv Transaction=* Jmeter_measure="ok.pct90"| chart avg(Jmeter_RT_val) by Transaction | rename avg(Jmeter_RT_val) AS "90%RT" |sort Transaction

alt text

which shows average response times of different transaction during a test in a bar chart format.

I want to compare results from two different time periods (Different tests) say between (10:30 09 July 2015 to 11:30 09 July 2015 ) and (12:30 08 July 2015 to 13:30 08 July 2015 ) so that I can see if there something taking longer time than before. I would prefer them to be in different colors.

0 Karma

woodcock
Esteemed Legend

This has been answered many times, just search for "Splunk timechart overlay". Any of these solutions should be workable:

http://answers.splunk.com/answers/122137/two-query-results-overlay-on-same-graph.html
http://answers.splunk.com/answers/12436/combine-searches-in-one-timechart.html
http://answers.splunk.com/answers/103229/timechart-overlay-multiple-strings.html

But in your case, you will have to add a time adjustment to one of your searches to have it "lie to Splunk" about when it happened so that the X-axis overlaps, just add the timeshift to the end of that search like this:

... | eval time=time+S0m3num83r
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...