Splunk Search

How to get stats with a percentage change for a certain field?

thunder_wu
Path Finder

In stats, I want something equal to (latest - earliest) / earliest for certain field. How I can achieve that?

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | stats earliest(certainField) AS earliest latest(certainField) AS latest | eval something = ((latest - earliest) / earliest)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | stats earliest(certainField) AS earliest latest(certainField) AS latest | eval something = ((latest - earliest) / earliest)
0 Karma

Richfez
SplunkTrust
SplunkTrust

I am assuming you have multiple values for the field in a single event (e.g. you've created a transaction or the event has multiple of that field already).

I'm also assuming it's a Unix epoch time, but this should work on any style of number. If you have a regular date string you need to do this on, you'll likely need to eval it using strptime(X,Y) to get it into that format.

So, if your field you want to perform the calculations on is a_time, you can do something like this.

... | eval a_start=min(a_time) | eval a_end=max(a_time)  
| eval a_mycalculation=(a_end-a_start)/a_start
| table a_start, a_end, a_mycalculation

Free of charge I gave you a handy table, too, but you may not need that. 🙂

As you can see, doing the math was just like you wrote, so hopefully this will get you close enough to figure out the details on you own. If not, please paste in a couple of the raw events you need to work with and perhaps expound on the requirements just a tad more and we can see what we can do!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...