Compare today to yesterday's results

Question

Hi how should I modify my search to make it work?

host="javaserver1" source="/var/log/javastuff.log" earliest=-1d@d latest=-0d@d Sending failed | multikv | eval ReportKey="yesterday" | append [search host="javaserver1" source="/var/log/javastuff.log" earliest=-0d@d latest=now Sending failed | multikv | eval ReportKey="today"] |timechart span="1h" count by ReportKey

While today's results are displayed, yesterday's results are zero for every hour, then when yesterday's results begin displaying other values than zero, today's results are displayed all as zeroes.

Any solution to this?

Thank you

Answer 1

1

The append command adds today's results as separate events following yesterday's. Then timechart sums the events based on _time, so the two series will not overlap. Try this instead

host="javaserver1" source="/var/log/javastuff.log" earliest=-1d@d latest=now Sending failed |
multikv | 
eval hour = strftime(_time,"%H") |
eval reportKey = if(_time<relative_time(now(), "-0d@d"),"yesterday","today") |
chart count over hour by reportKey

link

answered 15 Mar '12, 03:52

lguinn ♦
11.5k●5●8●24
accept rate: 28%

edited 22 Jun '12, 15:21

Answer 2

Another alternative:

host="javaserver1" source="/var/log/javastuff.log" earliest=-1d@d latest=-0d@d Sending failed | multikv | eval ReportKey="yesterday" | 
eval _time=relative_time(_time,"+1d") |
append [search host="javaserver1" source="/var/log/javastuff.log" earliest=-0d@d latest=now Sending failed | multikv | eval ReportKey="today"] |
timechart span="1h" count by ReportKey

Notice that this is the same as your original search BUT I added one day to the timestamp. This forces the data from yesterday to plot over the same time period as the data from today.

The other solution should be faster in most cases, but this will be more flexible when you really want to use a timechart.

Compare today to yesterday's results

Follow this question

Splunk Resources

Related questions