Splunk Search

compare response time from yesterday to today

mightaswelby
Explorer

Trying to compare response time from yesterday to today. This search seems to be working, but very, very slow. Any suggestions on how to improve it?

sourcetype=prd_banking_server Bank_Code = 108 earliest=@d latest=now
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Today"
| append
[search sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=-24@h
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Yesterday"
| eval _time=_time+(60*60*24*7)]
| timechart span=60m avg(Duration_Sec) by ReportKey

Tags (1)
0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

Have you tried the timewrap command? I just did this, and if you choose Line Chart in visualization, looks pretty cool, and seems to be pretty fast:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-2d@d
|eval Duration=duration/1000
| timechart avg(Duration) span=1h
| timewrap series=relative 24h

I obviously used different data:) I did it w/apache logs, and used response_time to generate the viz.

0 Karma

cmerriman
Super Champion

could you try this:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=now
| eval Duration_Sec = duration/1000
| multikv 
| eval ReportKey=if(_time>=relative_time(now(),"@d"),"Today","Yesterday")
| timechart span=60m avg(Duration_Sec) by ReportKey

I'm basically just trying to remove the subsearch in general and compiling ReportKey into one eval statement to define today and yesterday.

if you need yesterdays time to be shifted a day, add |eval _time=if(ReportKey="Yesterday",_time+86400,_time) before the timechart

cmerriman
Super Champion

after looking again, i see your shifting Yesterday a week ahead, [60*60*24*7] . you can use 604800 in the _time eval i provided, i'm just not sure why you're shifting it a week.

0 Karma

DalJeanis
Legend

@cmerriman - a day... a week...Hey, to God it's a thousand years anyway, right?

I also notice that what the OP posted, his "yesterday" search ended at the hour cutoff beforen 24 secondws ago.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...