Splunk Search

compare response time from yesterday to today

mightaswelby
Explorer

Trying to compare response time from yesterday to today. This search seems to be working, but very, very slow. Any suggestions on how to improve it?

sourcetype=prd_banking_server Bank_Code = 108 earliest=@d latest=now
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Today"
| append
[search sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=-24@h
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Yesterday"
| eval _time=_time+(60*60*24*7)]
| timechart span=60m avg(Duration_Sec) by ReportKey

Tags (1)
0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

Have you tried the timewrap command? I just did this, and if you choose Line Chart in visualization, looks pretty cool, and seems to be pretty fast:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-2d@d
|eval Duration=duration/1000
| timechart avg(Duration) span=1h
| timewrap series=relative 24h

I obviously used different data:) I did it w/apache logs, and used response_time to generate the viz.

0 Karma

cmerriman
Super Champion

could you try this:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=now
| eval Duration_Sec = duration/1000
| multikv 
| eval ReportKey=if(_time>=relative_time(now(),"@d"),"Today","Yesterday")
| timechart span=60m avg(Duration_Sec) by ReportKey

I'm basically just trying to remove the subsearch in general and compiling ReportKey into one eval statement to define today and yesterday.

if you need yesterdays time to be shifted a day, add |eval _time=if(ReportKey="Yesterday",_time+86400,_time) before the timechart

cmerriman
Super Champion

after looking again, i see your shifting Yesterday a week ahead, [60*60*24*7] . you can use 604800 in the _time eval i provided, i'm just not sure why you're shifting it a week.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@cmerriman - a day... a week...Hey, to God it's a thousand years anyway, right?

I also notice that what the OP posted, his "yesterday" search ended at the hour cutoff beforen 24 secondws ago.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...