new splunk user: trying to create a report that shows percentage change with successful logins per day
example: i have a field that shows successful logins, but there are several records in a day, so I do bucket _time span=1d. put all the records in one total number count. How can I show the change for the next day?
day 1 : 60 successful login
day 2: 100 successful login
day 3: 30 successful login
there is a 60% change from day 1 to day2, How can I chart that change? show a percentage?
Hello,
Could you try to use "streamstats" command?
http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Streamstats
This is my example search command.
index=_internal sourcetype=splunkd_access
| timechart span=1d count
| streamstats sum(count) AS prev current=f window=1
| eval count / prev * 100 - 100
| table _time count ratio
I hope it helps you.
Happy splunking!
How to find out the no of users who had not login per day