Splunk Search

Compare Results for 2 different time frames

sabari80
Explorer

Want to compare Dynatrace results (Total calls & Avg/90% responses times) for current week Vs Last week. And need to display the differences. 

Sample Query: 

index="dynatrace" sourcetype="dynatrace:usersession" | spath output=pp_user_action_user path=userId
| spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="xxxxxxx"
| spath output=pp_key_user_action input=user_actions path=keyUserAction
| where pp_key_user_action="true"| spath output=pp_user_action_name input=user_actions path=name
| spath output=pp_user_action_response input=user_actions path=visuallyCompleteTime | eval pp_user_action_name=substr(pp_user_action_name,0,150)
| eventstats avg(pp_user_action_response) AS "Avg_User_Action_Response" by pp_user_action_name
| stats count(pp_user_action_response) As "Total_Calls",perc90(pp_user_action_response) AS "Perc90_User_Action_Response" by pp_user_action_name Avg_User_Action_Response
| eval Perc90_User_Action_Response=round(Perc90_User_Action_Response,0)/1000| eval Avg_User_Action_Response=round(Avg_User_Action_Response,0)/1000
| table pp_user_action_name,Total_Calls,Avg_User_Action_Response,Perc90_User_Action_Response
| sort -Perc90_User_Action_Response
Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Pro tip: Instead of asking volunteers to reverse engineer complex codes and screenshots without explanation, it is much more productive to post sample/mock data in text (anonymize as needed), illustrate desired results in text, and explain the logic between data and desired results.  Post (pseudo) codes only if they help explanation; if posted code does not give desired results, also illustrate actual results or error message in text.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...