Splunk Search

What is the easiest way to get the percentage increase difference between two median values?

jundai
Explorer

This works wonderfully to give me the count and median per server farm, per URL:

index=wtf earliest=10/13/2014:10:00:00 latest=10/13/2014:11:00:00 | chart count, exactperc50(time_taken) as median over base_uri by farm

If I have two farms (say, canary and non-canary), how do I go about getting the % increase in the median for the canary servers?

bmunson_splunk
Splunk Employee
Splunk Employee

You need to use eventstats to create a value available to both farm events as follows

index=wtf earliest=10/13/2014:10:00:00 latest=10/13/2014:11:00:00 | chart count, exactperc50(time_taken) as median over base_uri by farm | eventsats min(median) as min | eval "% Diference" = (median/min-1)*100 | fields - min

This will show for all farms what percentage they are better than the worst.

0 Karma

somesoni2
Revered Legend

If the value for the field farm is static , which are "canary" and "non-canary" then you can add following eval to get the percentage change.

index=wtf earliest=10/13/2014:10:00:00 latest=10/13/2014:11:00:00 | chart count, exactperc50(time_taken) as median over base_uri by farm | eval "% difference:=round((canary-'non-canary')*100/'non-canary',2)

Let me know if they are non-static

0 Karma

hbakker
Engager

What if you wanted a chart that had multple comparisons, example: %difference Median and %difference TP95?

0 Karma

somesoni2
Revered Legend

You want to compare % increase in median between two farms?

0 Karma

jundai
Explorer

Yep. Let's say the time_taken median on non-canary is 500 ms, and time_taken median on canary is 600 ms. I'd like to have a column showing the % increase (difference), which in this case would be 20%.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...