I am building a dashboard where I want to overlay data from user choosen time period with another user choosen time period. For example yesterday's average transaction duration compared to today's average transaction duration. As an orientation I use the
Splunk Book( https://www.splunk.com/goto/book) chapter "Charting Week Over Week Results" (pages 85ff.).
So I created a dashboard with two time picker named past and present so the four tokens are accessible using statements like "$past.earliest$". However my code only works if the time tokens are set to a relative value like "1d@d" or "now" and don't work if a user uses a concrete point time (which means a unix-epoch time). Here is my current search:
index=some_index some_field="someValue" earliest=$past.earliest$ latest=$present.latest$
| eval dur_sec=duration/1000000
| eval marker = if ( (_time > relative_time(now(), "$past.earliest$") and _time < relative_time(now(),"$past.latest$")), "past", "today")
| eval _time = if (marker=="past", _time + relative_time(now(),"$present.earliest$")-relative_time(now(),"$past.earliest$"), _time)
| timechart span=30min max(dur_sec) by marker
| trendline sma5("past") as trend_last_week
| eval upperBound=if( isnotnull(trend_last_week), 'trend_last_week'*1.5,'past'*1.5),lowerBound=0
| eval isOutlier=if('today'>upperBound or 'today'<lowerBound,1,0)| where _time >= relative_time(now(),"$present.earliest$")| fields _time,"today",lowerBound,upperBound,isOutlier,*
As explained above this only works for relative time spans like "-1d@d" and "now". In simpler words this solution is not flexible enough. I also suspect that there might be an error in the line were I am recalculating the "_time" values, but I'm not sure yet.
Because of these problems, I thought about converting all values from my tokens to Unix Epoch Times with the following code:
| eval past_earliest=if(isnum(tonumber("$past.earliest$",10)),"$past.earliest$",relative_time(now(),"$past.earliest$"))
| eval past_latest=if(isnum(tonumber("$past.latest$",10)),"$past.latest$",relative_time(now(),"$past.latest$"))
| eval present_earliest=if(isnum(tonumber("$present.earliest$",10)),"$present.earliest$",relative_time(now(),"$present.earliest$"))
| eval present_latest=if(isnum(tonumber("$present.latest$",10)),"$present.latest$",relative_time(now(),"$present.latest$"))
This does not work if one of the tokens contains a non-numeric value. In this case the whole search can't be run. But I guess this code can be fixed but I don't know how.
Maybe somehow can help me complete this workaround or even has an idea fro improvement of the original search.
Any help is appreciated.
... View more
