Splunk Search

Tweaking xyseries

bmer
Explorer

Iam using splunk to generate as below.It is run for 2 days date range where am trying to compare the count

ClassName16-Oct-2417-Oct-24
ClassA544489
ClassB3947
ClassC19372100

 

My splunk query is as under

index=myindex RecordType=abc ClassName IN (
"ClassA",
"ClassB",
"ClassC")
| bucket _time span=1d
| stats avg(cpuTime) as avgCpuTime by ClassName _time
| xyseries ClassName _time avgCpuTime

I need below output which has an extra column that gives the comparision.How can we tweak this query?Is there another way to achieve this in more visually appealing manner

ClassName16-Oct-2417-Oct-24%Reduction
ClassA54448910%
ClassB3947-21%
ClassC19372100-8%
Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=myindex RecordType=abc ClassName IN (
"ClassA",
"ClassB",
"ClassC")
| bucket _time span=1d
| stats avg(cpuTime) as avgCpuTime by ClassName _time
| xyseries ClassName _time avgCpuTime
| eval "%Reduction"=round(100*('16-Oct-24'-'17-Oct-24')/'16-Oct-24',0)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=myindex RecordType=abc ClassName IN (
"ClassA",
"ClassB",
"ClassC")
| bucket _time span=1d
| stats avg(cpuTime) as avgCpuTime by ClassName _time
| xyseries ClassName _time avgCpuTime
| eval "%Reduction"=round(100*('16-Oct-24'-'17-Oct-24')/'16-Oct-24',0)
0 Karma

bmer
Explorer

@ITWhisperer Thanks. This was helpful.I tweaked it to include more aggregate function

0 Karma
Get Updates on the Splunk Community!

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...