What is the easiest way to get the percentage increase difference between two median values?

[jundai]

This works wonderfully to give me the count and median per server farm, per URL:

index=wtf earliest=10/13/2014:10:00:00 latest=10/13/2014:11:00:00 | chart count, exactperc50(time_taken) as median over base_uri by farm

If I have two farms (say, canary and non-canary), how do I go about getting the % increase in the median for the canary servers?

[bmunson_splunk]

You need to use eventstats to create a value available to both farm events as follows

index=wtf earliest=10/13/2014:10:00:00 latest=10/13/2014:11:00:00 | chart count, exactperc50(time_taken) as median over base_uri by farm | eventsats min(median) as min | eval "% Diference" = (median/min-1)*100 | fields - min

This will show for all farms what percentage they are better than the worst.

[somesoni2]

If the value for the field farm is static , which are "canary" and "non-canary" then you can add following eval to get the percentage change.

index=wtf earliest=10/13/2014:10:00:00 latest=10/13/2014:11:00:00 | chart count, exactperc50(time_taken) as median over base_uri by farm | eval "% difference:=round((canary-'non-canary')*100/'non-canary',2)

Let me know if they are non-static

[hbakker]

What if you wanted a chart that had multple comparisons, example: %difference Median and %difference TP95?

[somesoni2]

You want to compare % increase in median between two farms?

[jundai]

Yep. Let's say the time_taken median on non-canary is 500 ms, and time_taken median on canary is 600 ms. I'd like to have a column showing the % increase (difference), which in this case would be 20%.