Splunk Search

How to compare results of a bar chart from two different times

nitingurram
New Member

I have a search
index=* sourcetype=tsv Transaction=* Jmeter_measure="ok.pct90"| chart avg(Jmeter_RT_val) by Transaction | rename avg(Jmeter_RT_val) AS "90%RT" |sort Transaction

alt text

which shows average response times of different transaction during a test in a bar chart format.

I want to compare results from two different time periods (Different tests) say between (10:30 09 July 2015 to 11:30 09 July 2015 ) and (12:30 08 July 2015 to 13:30 08 July 2015 ) so that I can see if there something taking longer time than before. I would prefer them to be in different colors.

0 Karma

woodcock
Esteemed Legend

This has been answered many times, just search for "Splunk timechart overlay". Any of these solutions should be workable:

http://answers.splunk.com/answers/122137/two-query-results-overlay-on-same-graph.html
http://answers.splunk.com/answers/12436/combine-searches-in-one-timechart.html
http://answers.splunk.com/answers/103229/timechart-overlay-multiple-strings.html

But in your case, you will have to add a time adjustment to one of your searches to have it "lie to Splunk" about when it happened so that the X-axis overlaps, just add the timeshift to the end of that search like this:

... | eval time=time+S0m3num83r
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...