Reporting

What is the best way to generate a report to compare average time over last 30 days with today's average time?

uhkc777
Explorer

I want to compare Avg time to process over last 30 days data and Avg time for today. If today's Avg is < 30 days Avg i need to generate a report. I can write it by using append command to calculate average over last 30 days but it's taking lot of time to load every time. Is there any other way to built this?.

I read about summary indexing but not sure how is it helpful in this situation.

Any suggestions on this is helpful for me.

Thanks,

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Assuming you already got the query using append/appendcols to get and compare the average and only performance is the issue, I believe summary indexing/or datamodel will definitely help here. The query for last 30 days would be the one causing slower performance and if you can pre-calculate that (calculate running last 30 day average), it will be become faster.

0 Karma

uhkc777
Explorer

Thank you. How can I use datamodel in this?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

YOu can create data model for your base search (more info here)
and then accelerate it for appropriate Summary Range (30 day time period, see more info here ).

Then use the data model query to calculate 30 day (you can also use it for today's) average values. Will be much faster.

0 Karma

sundareshr
Legend

Try this

index=foo sourcetype=foo earliest=-3d@d | eval when=if(_time>relative_time(now(), "@d"), "Today", "Month") | stats avg(response_time) as avgtime by when

uhkc777
Explorer

What is Today and Month in eval?. It's taking it as strings.

0 Karma

sundareshr
Legend

Those values/strings are set based on the _time value. If _time is greater/newer than start of the day (@d), then it is Today, else Month

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...