compare response time from yesterday to today

[mightaswelby]

Trying to compare response time from yesterday to today. This search seems to be working, but very, very slow. Any suggestions on how to improve it?

sourcetype=prd_banking_server Bank_Code = 108 earliest=@d latest=now
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Today"
| append
[search sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=-24@h
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Yesterday"
| eval _time=_time+(60*60*24*7)]
| timechart span=60m avg(Duration_Sec) by ReportKey

[sshelly_splunk]

Have you tried the timewrap command? I just did this, and if you choose Line Chart in visualization, looks pretty cool, and seems to be pretty fast:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-2d@d
|eval Duration=duration/1000
| timechart avg(Duration) span=1h
| timewrap series=relative 24h

I obviously used different data:) I did it w/apache logs, and used response_time to generate the viz.

[cmerriman]

could you try this:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=now
| eval Duration_Sec = duration/1000
| multikv 
| eval ReportKey=if(_time>=relative_time(now(),"@d"),"Today","Yesterday")
| timechart span=60m avg(Duration_Sec) by ReportKey

I'm basically just trying to remove the subsearch in general and compiling ReportKey into one eval statement to define today and yesterday.

if you need yesterdays time to be shifted a day, add |eval _time=if(ReportKey="Yesterday",_time+86400,_time) before the timechart

[cmerriman]

after looking again, i see your shifting Yesterday a week ahead, [60*60*24*7] . you can use 604800 in the _time eval i provided, i'm just not sure why you're shifting it a week.

[DalJeanis]

@cmerriman - a day... a week...Hey, to God it's a thousand years anyway, right?

I also notice that what the OP posted, his "yesterday" search ended at the hour cutoff beforen 24 secondws ago.