Splunk Search

How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization?

Motivator

I am attempting to overlay last weeks CPU with this weeks CPU utilization, to give a side by side contrast.

Currently, I have the following:

sourcetype="mySourcetype" earliest=-7d@d latest=now | eval ReportKey="ThisWeek" | append [search sourcetype="mySourcetype"  earliest=-14d@d latest=-7d@d| eval ReportKey="LastWeek"  ] | timechart span=1d avg(pctCPU) by ReportKey

Which produces this chart: (I substituted minutes for days in the chart so it wouldn't take long to load)

alt text

Is there a way I can make this go over the same 'time', so it looks like a true over lay? Meaning if I set this to a weekly, Mon - Fri kind of time range?

1 Solution

SplunkTrust
SplunkTrust

Hi tmarlette,

try the timewrap app https://splunkbase.splunk.com/app/1645/ it does exactly what you want.

cheers, MuS

View solution in original post

Contributor

Or, you can shift time back for the second graph instead.
Refer a blog article covering this exact scenario

0 Karma

SplunkTrust
SplunkTrust

Hi tmarlette,

try the timewrap app https://splunkbase.splunk.com/app/1645/ it does exactly what you want.

cheers, MuS

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!