Splunk Search

Tweaking xyseries

bmer
Explorer

Iam using splunk to generate as below.It is run for 2 days date range where am trying to compare the count

ClassName16-Oct-2417-Oct-24
ClassA544489
ClassB3947
ClassC19372100

 

My splunk query is as under

index=myindex RecordType=abc ClassName IN (
"ClassA",
"ClassB",
"ClassC")
| bucket _time span=1d
| stats avg(cpuTime) as avgCpuTime by ClassName _time
| xyseries ClassName _time avgCpuTime

I need below output which has an extra column that gives the comparision.How can we tweak this query?Is there another way to achieve this in more visually appealing manner

ClassName16-Oct-2417-Oct-24%Reduction
ClassA54448910%
ClassB3947-21%
ClassC19372100-8%
Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=myindex RecordType=abc ClassName IN (
"ClassA",
"ClassB",
"ClassC")
| bucket _time span=1d
| stats avg(cpuTime) as avgCpuTime by ClassName _time
| xyseries ClassName _time avgCpuTime
| eval "%Reduction"=round(100*('16-Oct-24'-'17-Oct-24')/'16-Oct-24',0)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=myindex RecordType=abc ClassName IN (
"ClassA",
"ClassB",
"ClassC")
| bucket _time span=1d
| stats avg(cpuTime) as avgCpuTime by ClassName _time
| xyseries ClassName _time avgCpuTime
| eval "%Reduction"=round(100*('16-Oct-24'-'17-Oct-24')/'16-Oct-24',0)
0 Karma

bmer
Explorer

@ITWhisperer Thanks. This was helpful.I tweaked it to include more aggregate function

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...