How to search average response times at a specific time?

[nlrdy]

Hello,

I'm trying to write a splunk query but dont know where to start with. Is it possible to write a query to search for response times at a particular time on a day for example, comparing the response times today at 8:00 AM vs yesterday at 8:00 AM.

Thank you

[somesoni2 · Accepted solution]

Try something like this

your base search earliest=-1d@d latest=now |  where strftime(_time,"%H:%M")="08:00" | eval Period=if(_time>relative_time(now(),"-24h"),"Today","Yesterday") | eval temp=1| chart values(response_time) over temp by Period | fields - temp

[nlrdy]

thank you. this helps. what if I need this to be searched over three days for example today, yesterday and a week ago at the same time.