Splunk Search

How to plot differences of values over time?

henry_chiang
New Member

hi all

I have a data set like this:

_time, duration, category

XXX, 0.145,A

XXY, 0.177,B

XXZ, 0.178, A

XXX, XXY,XXZ are _time

i plot a graph like timechart avg(duration) by category and it shows two lines perfectly

but I want to plot a graph over time of the differences between the two averages (two categories). How to do that?

Labels (2)
0 Karma

woodcock
Esteemed Legend

Just add this:
| eval diff = B-A
| fields - A B

Like this:
index="_internal" AND source="*metrics.log" AND kb
| eval category=ev%2
| eval category = if(category==0, "A", "B")
| timechart avg(kb) BY category
| eval diff = B-A
| fields - A B

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If you examine the stats table after timechart commands, you will see two columns A and B.  Treat them the same as field names so you can calculate the difference.  For example,

| timechart avg(duration) by category
| eval diff = A - B
| fields diff

Hope this helps.

0 Karma

henry_chiang
New Member

Thanks it works fine!

but what if I did 

timechart avg(duration),p95(duration) by category

then how do I properly rename the fields to do the calculation between the averages and the p95s?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

When you use timechart with split by, the columns are named with the aggregation + the split, so use this technique

| timechart span=15m avg(duration) as avg p95(duration) as p95 by category
| foreach avg* [ eval "diff<<MATCHSTR>>"='p95<<MATCHSTR>>'-'<<FIELD>>' ]

By using 'as avg' and 'as p95' means you have consistent naming and you can then use the foreach, which will iterate all the avg: category fields and use the foreach tokens <<MATCHSTR>> and <<FIELD>> to reference the other fields.

So this will create fields diff: category which is the p95 - the avg. Note the use of SINGLE quotes on the right hand side and double quotes on the left!

 

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...