Hi Community,
This is a continuation from another post (https://community.splunk.com/t5/Splunk-Search/Line-Chart-Overlay-based-on-previous-month-and-previou...) but there are some key changes to the requirements, which is why I created a new post here.
I would like to have a search that allows me to compare (overlay) discrete data from 2 different time period (could be a full month /day, etc.) based on the time picker selection.
Sample of requirement (the time period should be selected based on 2 separate timepickers):
Here is the solution from the previous post which compares between the previous month and the month before that.
-- base query
--setting earliest as -2mon@mon and latest as -0mon@mon
| eval month=strftime(_time,"%m")
| stats count as ABC by month condition1 condition2
| eval EFG=round(ABC/1000,3)
| stats sum(EFG) as XYZ by condition1 month
| xyseries condition1 month XYZ
Question 1: How can I change the query to allow the time picker's token (a total of 2 separate time periods) to be passed it ("eval month=..." portion?) to eventually plot it in the xyseries?
Question 2: How do I set the time picker token to the time(or period selected in timepicker) and use it in the dashboard panel's title?
...
...
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-2mon@mon</earliest>
<latest>@mon</latest>
</default>
</input>
</fieldset>
<init>
<eval token="monthofperiod1">strftime(relative_time(time($field1$), "???"), "%b")</eval>
</init>
<row>
<panel>
<title>Sample Period: $monthofperiod1$</title>
...
...
Thanks in advance!
Hi,
Thanks for your reply.
Seems to be getting closer. However, the calculations at panel 1 and 2 are for multiple categories.
Panel 1:
...
| chart values(Total) as TOTAL1 by column
Panel 2:
...
| chart values(Total) as TOTAL2 by column
The final eval $panel1$-$panel2$ is also for multiple categories (for the 'by column' portion).
How I can I modify it to pass the results with the 'by column' criteria?
For example:
The intended output is to pass the value to the lowest panel
Thanks in advance!
Hi
I've tried to modify it to by adding the following at panel 1 and panel 2:
.....
| stats values(Total) by column
| eval tmp=sourcetype."=".count
| stats values(tmp) as tmp values(Total) as Total
| eval count=mvjoin(tmp,";")</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<set token="panel1">$result.count$</set>
<set token="total1">$result.Total$</set>
</done>
....
...
| stats values(Total) by column
| eval tmp=sourcetype."=".count
| stats values(tmp) as tmp values(Total) as Total
| eval count=mvjoin(tmp,";")</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<set token="panel2">$result.count$</set>
<set token="total2">$result.Total$</set>
</done>
And have added this at panel 3:
<search>
<query>| makeresults
| eval result1=split("$panel2$",";"), result2=split("$panel1$",";")
| eval result=mvappend(result1,result2)
| mvexpand result | fields - result1 result2
| rex field=result "(?<sourcetype>[^=]+)=(?<value>\d+)"
| stats sum(value) as count by sourcetype</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
However I faced two issues here and would like to seek your help on it:
1. Panel 3 shows "Search is waiting for input"
2. Panel 1 and 2 now shows "No result found" instead of the previous column chart like what was intended:
Hi,
Noted on the * -1 portion.
Currently, Panel 3 has a results column like this:
ABC=0.24
DEF=1.45
GHI=3.12
JKL=0.56
ABC=-2.1
DEF=-6.4
GHI=-0.2
JKL=-0.3
I changed the regex to
| rex field=result "(?<column>[^=]+)=(?<value>.*)"
However, all the negative values are now positive. The x-axis is also a stacked side by side looking like this:
And also, Panel 1 and Panel 2's results are now being merged as well, with the xaxis being the 'tmp' which looks like this: 'ABC=1,DEF=2,GHI=3....'. The yaxis values has also been changed. How can I convert this portion back to the previous visualization without affecting the token being passed to panel 3?
