Trying to compare response time from yesterday to today. This search seems to be working, but very, very slow. Any suggestions on how to improve it?
sourcetype=prd_banking_server Bank_Code = 108 earliest=@d latest=now
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Today"
| append
[search sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=-24@h
| eval Duration_Sec = duration/1000
| multikv
| eval ReportKey="Yesterday"
| eval _time=_time+(60*60*24*7)]
| timechart span=60m avg(Duration_Sec) by ReportKey
↧