Splunk Search

compare response time from yesterday to today

mightaswelby
Explorer

Trying to compare response time from yesterday to today. This search seems to be working, but very, very slow. Any suggestions on how to improve it?

sourcetype=prd_banking_server Bank_Code = 108 earliest=@d latest=now
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Today"
| append
[search sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=-24@h
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Yesterday"
| eval _time=_time+(60*60*24*7)]
| timechart span=60m avg(Duration_Sec) by ReportKey

Tags (1)
0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

Have you tried the timewrap command? I just did this, and if you choose Line Chart in visualization, looks pretty cool, and seems to be pretty fast:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-2d@d
|eval Duration=duration/1000
| timechart avg(Duration) span=1h
| timewrap series=relative 24h

I obviously used different data:) I did it w/apache logs, and used response_time to generate the viz.

0 Karma

cmerriman
Super Champion

could you try this:

sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=now
| eval Duration_Sec = duration/1000
| multikv 
| eval ReportKey=if(_time>=relative_time(now(),"@d"),"Today","Yesterday")
| timechart span=60m avg(Duration_Sec) by ReportKey

I'm basically just trying to remove the subsearch in general and compiling ReportKey into one eval statement to define today and yesterday.

if you need yesterdays time to be shifted a day, add |eval _time=if(ReportKey="Yesterday",_time+86400,_time) before the timechart

cmerriman
Super Champion

after looking again, i see your shifting Yesterday a week ahead, [60*60*24*7] . you can use 604800 in the _time eval i provided, i'm just not sure why you're shifting it a week.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@cmerriman - a day... a week...Hey, to God it's a thousand years anyway, right?

I also notice that what the OP posted, his "yesterday" search ended at the hour cutoff beforen 24 secondws ago.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...