If I select 2023, Aug 12 for last 30 days, then in the chart I need two line2023 data from Now to -30 days
2022 data from "now-1y" to -30 days
Can we plot this in single time chart ?
You need to very carefully state your use case (without using SPL). Your sample code definitely does not suggest two time intervals. Now that you need two time intervals, you also need to specify
- How do you "select 2023, Aug 12 for last 30 days?" Do you use a time input? (I will assume yes.)
- Is this input independent of the other user selection of version, i.e., 2024 or 2023? (I will also assume yes.)
Without these specifics, your question is unanswerable. You also should specify how the result should look like, and give some mock data, then illustrate some mock result. SPL should be the last thing to illustrate; if you illustrate SPL that does not give you desired results, you should illustrate actual output from the code when applied to the exact illustrated dataset.
Anyway, my solution is the same: set up tokens to modify search terms. As I mentioned, you can set up auxiliary tokens based on user selection. In this example, I add two additional tokens $early_start$ and $early_end$ base on the time selector $interval$. Your search term should be
index=cls_prod_app applicationversion IN ($applicationversion$)
((earliest=$interval.earliest$ latest=$interval.latest$) OR (earliest = $early_start$ latest = $early_end$))
appname=Lacerte message="featureperfmetrics" NOT(isinternal="*") taxmodule=$taxmodule$ $hostingprovider$ datapath=* operation=createclient $concurrentusers$
| eval totaltimeinsec = totaltime/1000
| bin span=1m _time
| timechart p95(totaltimeinsec) as RecordedTime by applicationversion limit=0Here is a demo dashboard in Simple XML. (Token management in Dashboard Studio is different, but the same principle applies.)
<form version="1.1" theme="light">
<label>Set token applicationversion</label>
<description>https://community.splunk.com/t5/Splunk-Search/YoY-query-for-comparing-two-products-together/m-p/695943</description>
<search>
<query>
| makeresults
</query>
<progress>
<eval token="early_start">if(match($interval.earliest$, "-"), $interval.earliest$ . "-1y", relative_time($interval.earliest$, "-1y"))</eval>
<eval token="early_end">case(match($interval.latest$, "-"), $interval.latest$ . "-1y", $interval.latest$ == "now", relative_time(now(), "-1y"), true(), relative_time($interval.latest$, "-1y"))</eval>
</progress>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="applicationversion" searchWhenChanged="true">
<label>Version</label>
<choice value="2024,2023">2024</choice>
<choice value="2023,2022">2023</choice>
<initialValue>2024,2023</initialValue>
</input>
<input type="time" token="interval">
<label></label>
<default>
<earliest>-30d@d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>(earliest = $interval.earliest$, latest = $interval.latest$) OR (earliest = $early_start$ latest = $early_end$) applicationversion IN ($applicationversion$)</title>
<html>Your end search would be
<pre>
index=cls_prod_app applicationversion IN ($applicationversion$)
((earliest=$interval.earliest$ latest=$interval.latest$) OR (earliest = $early_start$ latest = $early_end$))
appname=Lacerte message="featureperfmetrics" NOT(isinternal="*") taxmodule=$taxmodule$ $hostingprovider$ datapath=* operation=createclient $concurrentusers$
| eval totaltimeinsec = totaltime/1000
| bin span=1m _time
| timechart p95(totaltimeinsec) as RecordedTime by applicationversion limit=0
</pre>
</html>
</panel>
</row>
</form>Play with this dashboard. If you select applicationvesion: 2023 and date range July 13, 2023 - August 12, 2023, your search will be rendered as
index=cls_prod_app applicationversion IN (2023,2022)
((earliest=1689231600 latest=1691910000) OR (earliest = 1691218800 latest = 1691834497))
appname=Lacerte message="featureperfmetrics" NOT(isinternal="*") taxmodule=$taxmodule$ $hostingprovider$ datapath=* operation=createclient $concurrentusers$
| eval totaltimeinsec = totaltime/1000
| bin span=1m _time
| timechart p95(totaltimeinsec) as RecordedTime by applicationversion limit=0
Try running the search in the search app and look at the job - here I have done a similar search but I don't have access to your data and my indexes don't hold any data as far back as a year so I have used the last hour and the same time the previous day
index=_audit
[| makeresults
| eval latest=relative_time(now(),"@h")
| eval row=mvrange(0,2)
| mvexpand row
| eval latest=relative_time(latest,"@h-".row."d")
| eval earliest=relative_time(latest,"-1h")
| table earliest latest]
| bin span=1h _time
| stats count by _time
Go to Inspect Job
Then Job Details Dashboard and look at the Map Phase Search String
You should see the time periods being searched. They will be in epoch time so you can copy them into another search to show their formatted versions
Do yours correlate to the values you were expecting
