Using the timeshift Operator for Comparison

Introduction

The timeshift operator is used to display graph data from a prior time frame. timeshift is especially useful when comparing data from different time periods within the same graph. This article explains how to use timeshift within dashboards and the graph view.

It should be noted that the timeshift operator is only supports conventional graphs at this time. Our Engineering team is reviewing ways to integrate the timeshift operator into PowerQuery-based graphs.

Examples

Graph View

For the search query tag='httpMonitor'

Select the time attribute from the left column and click the "Graph Values" button on the dialog:

A graph for the log data is displayed:

From here, we can update the query with graph-specific terms:

mean(time where tag='httpMonitor')

Similarly, we can immediately view the corresponding log data from the same time range 14 days ago:

mean(time timeshift 14d where tag='httpMonitor')

Graphs can also be compared directly when using the "Compare" and accompanying "Function" menus in the UI:

Dashboard Graph

The configuration of a dashboard graph is very similar to the graph view, however, the user has more control over the layout of the graph since all settings can be managed via the graph UI (or the configuration JSON).

Graph UI

For comparison purposes, we configure two plots. The "14d ago" plot employs the timeshift operator

Configuration JSON

...  
  {
    graphStyle: "line",
    lineSmoothing: "straightLines",
    plots: [
     {
      color: "",
      facet: "mean(time)",
      filter: "tag='httpMonitor'",
      label: "Present"
     },
     {
      color: "",
      filter: "mean(time timeshift 14d where tag='httpMonitor')",
      label: "14d ago"
     }
    ],
    title: "Monitor Response Time (14d ago vs Present)"
   },
...

As you can see, there are minor differences between the "Present" and "14d ago" plots. Namely,

• "14d ago" does not utilize a facet and the filter parameter contains the calculation function (mean)
• In "14d ago", the timeshift plot is integral to the facet

Result

The final result enables time-based comparisons to be made within a single graph. Please note that:

• 14 days is calculated from the current time
• The interval (4 hours) is specified in the time range selection of the dashboard