Splunk Search

How to plot differences of values over time?

New Member

hi all

I have a data set like this:

_time, duration, category

XXX, 0.145,A

XXY, 0.177,B

XXZ, 0.178, A

XXX, XXY,XXZ are _time

i plot a graph like timechart avg(duration) by category and it shows two lines perfectly

but I want to plot a graph over time of the differences between the two averages (two categories). How to do that?

Labels (2)
0 Karma

Esteemed Legend

Just add this:
| eval diff = B-A
| fields - A B

Like this:
index="_internal" AND source="*metrics.log" AND kb
| eval category=ev%2
| eval category = if(category==0, "A", "B")
| timechart avg(kb) BY category
| eval diff = B-A
| fields - A B

0 Karma


If you examine the stats table after timechart commands, you will see two columns A and B.  Treat them the same as field names so you can calculate the difference.  For example,

| timechart avg(duration) by category
| eval diff = A - B
| fields diff

Hope this helps.

0 Karma

New Member

Thanks it works fine!

but what if I did 

timechart avg(duration),p95(duration) by category

then how do I properly rename the fields to do the calculation between the averages and the p95s?

0 Karma


When you use timechart with split by, the columns are named with the aggregation + the split, so use this technique

| timechart span=15m avg(duration) as avg p95(duration) as p95 by category
| foreach avg* [ eval "diff<<MATCHSTR>>"='p95<<MATCHSTR>>'-'<<FIELD>>' ]

By using 'as avg' and 'as p95' means you have consistent naming and you can then use the foreach, which will iterate all the avg: category fields and use the foreach tokens <<MATCHSTR>> and <<FIELD>> to reference the other fields.

So this will create fields diff: category which is the p95 - the avg. Note the use of SINGLE quotes on the right hand side and double quotes on the left!


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...