Splunk Search

Compare Results for 2 different time frames

sabari80
Explorer

Want to compare Dynatrace results (Total calls & Avg/90% responses times) for current week Vs Last week. And need to display the differences. 

Sample Query: 

index="dynatrace" sourcetype="dynatrace:usersession" | spath output=pp_user_action_user path=userId
| spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="xxxxxxx"
| spath output=pp_key_user_action input=user_actions path=keyUserAction
| where pp_key_user_action="true"| spath output=pp_user_action_name input=user_actions path=name
| spath output=pp_user_action_response input=user_actions path=visuallyCompleteTime | eval pp_user_action_name=substr(pp_user_action_name,0,150)
| eventstats avg(pp_user_action_response) AS "Avg_User_Action_Response" by pp_user_action_name
| stats count(pp_user_action_response) As "Total_Calls",perc90(pp_user_action_response) AS "Perc90_User_Action_Response" by pp_user_action_name Avg_User_Action_Response
| eval Perc90_User_Action_Response=round(Perc90_User_Action_Response,0)/1000| eval Avg_User_Action_Response=round(Avg_User_Action_Response,0)/1000
| table pp_user_action_name,Total_Calls,Avg_User_Action_Response,Perc90_User_Action_Response
| sort -Perc90_User_Action_Response
Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Pro tip: Instead of asking volunteers to reverse engineer complex codes and screenshots without explanation, it is much more productive to post sample/mock data in text (anonymize as needed), illustrate desired results in text, and explain the logic between data and desired results.  Post (pseudo) codes only if they help explanation; if posted code does not give desired results, also illustrate actual results or error message in text.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...