Query for comparing 2 different time periods

[WeiMar]

Hi together,
I try to compare the PERC90 response times of an application before and after a software release for the 50 most used actions.

Here's the query

index=myindex source=mysource 
| rex field=_raw "^(?:[^;\n]*;){4}\s+(?P<utc_tsl_tranid>\w+:\w+)" 
| rex field=_raw "^.+\/(?P<ui_locend>\w+\.[a-z_-]+\.\w+\.\w+)" 
| dedup utc_tsl_tranid 
| stats sum(DURATION) as weight by ui_locend 
| sort - weight | head 50

Is there a way I can compare 2 time periods (for example: first start 2024-08-10 end 2024-08-15, second start 2024-08-20 end 2024-08-25). 

Field ui_locend has to match and I like to compare PERC(90) of DURATION, which can be calculated with STATS-Command.

It's a tricky one, will appreciate every idea.

[WeiMar]

That was quick, thank you!

I always struggle a little bit with the date formats. Which formats are accepted in den <periods>-fields or what do I have to do, that format yyyy-mm-dd (without time) is possible?

[ITWhisperer]

Change the time period of your search to include both time periods e.g. (earliest=<start of first period> latest=<end of first period>) OR (earliest=<start of second period> latest=<end of second period>). Then evaluate which period the event falls into eval period=if(_time < end of first period, "first", "second"). Then add period to you by clause.