One simple way might be to just compare the Call concurrency and gateway utilization for the two time periods.
Build the search for the first time period
For the first, click Report then Call concurrency and gateway utilization. Change the time range to something appropriate, like Other->Previous Week (or since today is Thursday, I’m going to select “Week to date” because that’s close enough), and select the gateway you want to examine.
Now open a new page for the new time period
Now, using whatever method you prefer to open a new tab and navigate to this same page. (I recommend in this case to right-click on the browser’s tab, select “Duplicate tab” or whatever your browser’s option for that is).
On the new tab, change the time frame to a corresponding typical week before all this stuff started happening. Like, the first week of February or something. Get those side by side and compare!
Eyeballs and the human brain are pretty amazing at finding these sorts of differences. Do be careful of the scale on each.
Super fun but advanced way
All right, time to play!
As above, start from Report then Call concurrency and gatewayutilization. Change the options to select the one gateway we’d like to look at, leaving everything else where it is.
Now, click the “» see search syntax” link.
Don’t be scared! We’ve totally hidden all the scariness behind macros, so lucky you!
(You can show the actual macros involved by, while having your cursor in the SPL/text editing box, pressing Ctrl‑e (or splat‑e on a mac, I think?). Anyone who can make an attempt at explaining “how this works” gets a free t‑shirt! And Nick doesn’t even know that I’ve thrown down this gauntlet, but I’m sure he won’t mind. Email it to me at [email protected]sideviewapps.com which is just an alias that points at me anyway.)
All right, what in the world do we do here? I’ll number the three little things to change:
Change the timeframe from whatever it is currently, to something long enough that you’d want to show the difference over. Like, “last 4 weeks” or maybe “Month to date” if it’s nearly the end of the month.
In the empty line between the timechart_for_concurrency macro and the fields command, add | timewrap 1week
Finally, put a * after your gateway in the fields command, like in my case change | fields _time _span VGW1 to | fields _time _span VGW1*
Here’s after I’ve changed it and run the search. IGNOREMYBUSTEDTESTDATA, I only have a week so I have to make it repeat to do longer than a week periods, so the data just lays on top of itself.
What this will did was 1) make sure we have enough data to compare with. 2) split the resulting timechart into 1 week chunks with the labels being things like <mygateway>_2weeks_before, and 3) tell the fields command to include any fields starting with your gateway name.
Doing the same thing only with an example to show you it really does work
Just to make sure you can see what this will look like, I’m going to do this same process over a week (Previous week) and timewrap it day by day. Here I just point out where I made those changes, just so you don’t forget.
Now we can plainly see that “things happen”.
A few explanations: In the time period “previous week”
The last day of that time period (Saturday) will be the “VGW1_latest_day”.
The day before that (Friday) is VGW1_1day_before
The day before that (Thursday) is VGW1_2days_before
and so on.
There are options to changing the labels to some extent, and you can read about other time periods instead of just 1day and 1week in a link down in the References section. I will only warn you that … be patient. This can be a slow report. 🙂