Dashboards & Visualizations

Compare two timerange in one report

LauraBre
Communicator

Hello,

I did a chart where compare two timeranges. This is my search:

source="tcp:5543" Service_Type="*" earliest=-0d@d latest=now | multikv | eval ReportKey="today" | append [search source="tcp:5543" Service_Type="*" earliest=-1d@d latest=-0d@d| multikv | eval ReportKey="yesterday" | eval _time=_time+86400] | timechart span=5m count(Service_Type) as "Number of Services"  by ReportKey

But I have the following messages when I launched it :

[subsearch]: Your timerange was substituted based on your search string
Your timerange was substituted based on your search string

But I don't understand where is the problem.

Thx by advance.

Tags (1)
1 Solution

carasso
Splunk Employee
Splunk Employee

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.

I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.

... | timechart count span=1h | timewrap d

That's it!

http://apps.splunk.com/app/1645/

View solution in original post

carasso
Splunk Employee
Splunk Employee

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.

I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.

... | timechart count span=1h | timewrap d

That's it!

http://apps.splunk.com/app/1645/

MuS
SplunkTrust
SplunkTrust

Hi LauraBre

usually this is only a information that the time range was set to the time range of your search and not what was chosen with the time picker besides the search box. I was not 100% sure, but I think you can suppress this kind of message somehow.....

yes, you can suppress it, just follow the instruction from here

hope this helps
cheers,

MuS

LauraBre
Communicator

Thx very much, I look for this and I post my answer if I choose it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...