Compare today to yesterday's results

[dackamen]

Hi how should I modify my search to make it work?

host="javaserver1" source="/var/log/javastuff.log" earliest=-1d@d latest=-0d@d Sending failed | multikv | eval ReportKey="yesterday" | append [search host="javaserver1" source="/var/log/javastuff.log" earliest=-0d@d latest=now Sending failed | multikv | eval ReportKey="today"] |timechart span="1h" count by ReportKey

While today's results are displayed, yesterday's results are zero for every hour, then when yesterday's results begin displaying other values than zero, today's results are displayed all as zeroes.

Any solution to this?

Thank you

[carasso · Accepted solution]

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.

I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.

... | timechart count span=1h | timewrap d 

That's it!

http://apps.splunk.com/app/1645/

[lguinn2]

Another alternative:

host="javaserver1" source="/var/log/javastuff.log" earliest=-1d@d latest=-0d@d Sending failed | multikv | eval ReportKey="yesterday" | 
eval _time=relative_time(_time,"+1d") |
append [search host="javaserver1" source="/var/log/javastuff.log" earliest=-0d@d latest=now Sending failed | multikv | eval ReportKey="today"] |
timechart span="1h" count by ReportKey

Notice that this is the same as your original search BUT I added one day to the timestamp. This forces the data from yesterday to plot over the same time period as the data from today.

The other solution should be faster in most cases, but this will be more flexible when you really want to use a timechart.

[lguinn2]

The append command adds today's results as separate events following yesterday's. Then timechart sums the events based on _time, so the two series will not overlap. Try this instead

host="javaserver1" source="/var/log/javastuff.log" earliest=-1d@d latest=now Sending failed |
multikv | 
eval hour = strftime(_time,"%H") |
eval reportKey = if(_time<relative_time(now(), "-0d@d"),"yesterday","today") |
chart count over hour by reportKey

[vickyvishwa]

Thank you.
How do we compare today's hour and previous week same day/hour with this query ? Can u suggest ?