If I select 2023, Aug 12 for last 30 days, then in the chart I need two line 2023 data from Now to -30 days 2022 data from "now-1y" to -30 days Can we plot this in single time chart ? You...
See more...
If I select 2023, Aug 12 for last 30 days, then in the chart I need two line 2023 data from Now to -30 days 2022 data from "now-1y" to -30 days Can we plot this in single time chart ? You need to very carefully state your use case (without using SPL). Your sample code definitely does not suggest two time intervals. Now that you need two time intervals, you also need to specify How do you "select 2023, Aug 12 for last 30 days?" Do you use a time input? (I will assume yes.) Is this input independent of the other user selection of version, i.e., 2024 or 2023? (I will also assume yes.) Without these specifics, your question is unanswerable. You also should specify how the result should look like, and give some mock data, then illustrate some mock result. SPL should be the last thing to illustrate; if you illustrate SPL that does not give you desired results, you should illustrate actual output from the code when applied to the exact illustrated dataset. Anyway, my solution is the same: set up tokens to modify search terms. As I mentioned, you can set up auxiliary tokens based on user selection. In this example, I add two additional tokens $early_start$ and $early_end$ base on the time selector $interval$. Your search term should be index=cls_prod_app applicationversion IN ($applicationversion$)
((earliest=$interval.earliest$ latest=$interval.latest$) OR (earliest = $early_start$ latest = $early_end$))
appname=Lacerte message="featureperfmetrics" NOT(isinternal="*") taxmodule=$taxmodule$ $hostingprovider$ datapath=* operation=createclient $concurrentusers$
| eval totaltimeinsec = totaltime/1000
| bin span=1m _time
| timechart p95(totaltimeinsec) as RecordedTime by applicationversion limit=0 Here is a demo dashboard in Simple XML. (Token management in Dashboard Studio is different, but the same principle applies.) <form version="1.1" theme="light">
<label>Set token applicationversion</label>
<description>https://community.splunk.com/t5/Splunk-Search/YoY-query-for-comparing-two-products-together/m-p/695943</description>
<search>
<query>
| makeresults
</query>
<progress>
<eval token="early_start">if(match($interval.earliest$, "-"), $interval.earliest$ . "-1y", relative_time($interval.earliest$, "-1y"))</eval>
<eval token="early_end">case(match($interval.latest$, "-"), $interval.latest$ . "-1y", $interval.latest$ == "now", relative_time(now(), "-1y"), true(), relative_time($interval.latest$, "-1y"))</eval>
</progress>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="applicationversion" searchWhenChanged="true">
<label>Version</label>
<choice value="2024,2023">2024</choice>
<choice value="2023,2022">2023</choice>
<initialValue>2024,2023</initialValue>
</input>
<input type="time" token="interval">
<label></label>
<default>
<earliest>-30d@d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>(earliest = $interval.earliest$, latest = $interval.latest$) OR (earliest = $early_start$ latest = $early_end$) applicationversion IN ($applicationversion$)</title>
<html>Your end search would be
<pre>
index=cls_prod_app applicationversion IN ($applicationversion$)
((earliest=$interval.earliest$ latest=$interval.latest$) OR (earliest = $early_start$ latest = $early_end$))
appname=Lacerte message="featureperfmetrics" NOT(isinternal="*") taxmodule=$taxmodule$ $hostingprovider$ datapath=* operation=createclient $concurrentusers$
| eval totaltimeinsec = totaltime/1000
| bin span=1m _time
| timechart p95(totaltimeinsec) as RecordedTime by applicationversion limit=0
</pre>
</html>
</panel>
</row>
</form> Play with this dashboard. If you select applicationvesion: 2023 and date range July 13, 2023 - August 12, 2023, your search will be rendered as index=cls_prod_app applicationversion IN (2023,2022)
((earliest=1689231600 latest=1691910000) OR (earliest = 1691218800 latest = 1691834497))
appname=Lacerte message="featureperfmetrics" NOT(isinternal="*") taxmodule=$taxmodule$ $hostingprovider$ datapath=* operation=createclient $concurrentusers$
| eval totaltimeinsec = totaltime/1000
| bin span=1m _time
| timechart p95(totaltimeinsec) as RecordedTime by applicationversion limit=0