Splunk Search

How to compare results of a bar chart from two different times

nitingurram
New Member

I have a search
index=* sourcetype=tsv Transaction=* Jmeter_measure="ok.pct90"| chart avg(Jmeter_RT_val) by Transaction | rename avg(Jmeter_RT_val) AS "90%RT" |sort Transaction

alt text

which shows average response times of different transaction during a test in a bar chart format.

I want to compare results from two different time periods (Different tests) say between (10:30 09 July 2015 to 11:30 09 July 2015 ) and (12:30 08 July 2015 to 13:30 08 July 2015 ) so that I can see if there something taking longer time than before. I would prefer them to be in different colors.

0 Karma

woodcock
Esteemed Legend

This has been answered many times, just search for "Splunk timechart overlay". Any of these solutions should be workable:

http://answers.splunk.com/answers/122137/two-query-results-overlay-on-same-graph.html
http://answers.splunk.com/answers/12436/combine-searches-in-one-timechart.html
http://answers.splunk.com/answers/103229/timechart-overlay-multiple-strings.html

But in your case, you will have to add a time adjustment to one of your searches to have it "lie to Splunk" about when it happened so that the X-axis overlaps, just add the timeshift to the end of that search like this:

... | eval time=time+S0m3num83r
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...