Splunk Search

How to plot differences of values over time?

New Member

hi all

I have a data set like this:

_time, duration, category

XXX, 0.145,A

XXY, 0.177,B

XXZ, 0.178, A

XXX, XXY,XXZ are _time

i plot a graph like timechart avg(duration) by category and it shows two lines perfectly

but I want to plot a graph over time of the differences between the two averages (two categories). How to do that?

Labels (2)
0 Karma

Esteemed Legend

Just add this:
| eval diff = B-A
| fields - A B

Like this:
index="_internal" AND source="*metrics.log" AND kb
| eval category=ev%2
| eval category = if(category==0, "A", "B")
| timechart avg(kb) BY category
| eval diff = B-A
| fields - A B

0 Karma


If you examine the stats table after timechart commands, you will see two columns A and B.  Treat them the same as field names so you can calculate the difference.  For example,

| timechart avg(duration) by category
| eval diff = A - B
| fields diff

Hope this helps.

0 Karma

New Member

Thanks it works fine!

but what if I did 

timechart avg(duration),p95(duration) by category

then how do I properly rename the fields to do the calculation between the averages and the p95s?

0 Karma


When you use timechart with split by, the columns are named with the aggregation + the split, so use this technique

| timechart span=15m avg(duration) as avg p95(duration) as p95 by category
| foreach avg* [ eval "diff<<MATCHSTR>>"='p95<<MATCHSTR>>'-'<<FIELD>>' ]

By using 'as avg' and 'as p95' means you have consistent naming and you can then use the foreach, which will iterate all the avg: category fields and use the foreach tokens <<MATCHSTR>> and <<FIELD>> to reference the other fields.

So this will create fields diff: category which is the p95 - the avg. Note the use of SINGLE quotes on the right hand side and double quotes on the left!


0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...