Splunk Search

Overlaying a previous years data on chart

jackreeves
Explorer

I am displaying some data by Month for 2018/2019 (i.e. 01-2018, 02-2018) on a barchart.

Search Query:
( sourcetype=sourcetype1) OR (sourcetype=sourcetype2) OR (sourcetype=sourcetype3)
| chart sum(eval(if(sourcetype="sourcetype1",ICOS,NULL))) as Actuals sum(eval(if(sourcetype="sourcetype2",ICOS,NULL))) as Forecast sum(eval(if(sourcetype="sourcetype3",ICOS,NULL))) as Budget over "Month"

However I also want to be able to overlay 2017 data so that 2017-01 is shown above 2018-01 without adding to the x-axis.

Any ideas how I could do that?

0 Karma

grittonc
Contributor

If you are using Splunk 6.5 or higher, the timewrap function should be available and does exactly this.

https://answers.splunk.com/answers/468177/is-timewrap-an-official-spl-command-in-splunk-65.html

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap

You would first summarize your data using timechart, then use timewrap in the next pipe.

|timechart span=1m sum(my_field) | timewrap span=1y

The above should give you a year-over-year chart by month.

kmorris_splunk
Splunk Employee
Splunk Employee

Here is a technique from Exploring Splunk by David Carasso. I recommend downloading this since it has several good examples in it. This search shows how to compare last weeks results to this weeks results on the same chart, by labeling data from last week and this week, then adjusting _time so they line up for charting.

earliest=-2w@w latest=@w
 | eval marker = if (_time < relative_time(now(), “-1w@w”),
 “last week”, “this week”)
 | eval _time = if (marker==”last week”,
 _time + 7*24*60*60, _time)
 | timechart avg(bytes) by marker
0 Karma

jackreeves
Explorer

Thanks for the response. The pdf is very interesting.

I believe this would be quite messy when you try and apply across 12 months. Any alternatives?

0 Karma

jackreeves
Explorer

Added below to search and has worked 🙂
| appendcols
[ search index=finance sourcetype=hfm_actuals Country1="EMEIA" AND Organisation="DTS_DWS" "Financial Year ending"=2018
| eval _time=relative_time((_time),"+1year")
| chart sum(ICOS) as "FY18 Actuals" over Month]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...