- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Day to day % Difference
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi guys,
I create daily reports with various data on that we collect, and i am now looking to add a few extra bits of information that will be useful to the team.
I am looking to create a chart that show the % difference from the today's data against the data received the day before. For example if we received 100 events yesterday and 200 today it shows an increase of 100%. Any help would be very much appreciated.
Cheers,
Allan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally, streamstats should be used for this (depending upon what is your current search). However, delta can be used if you query is a simple scenario like a timechart being plotted for daily span. The delta command will give you the difference of count in the current row with previous row. This way you will have a way to identify what was the previous day's total. See the following run anywhere search based on Splunk's _internal index.
index=_internal sourcetype="splunkd" log_level="WARN"
| timechart span=1d count
| delta count as Delta
| fillnull value=0 Delta
| eval Total=count-Delta
| eval percIncrDecr=(Delta/Total)*100
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally, streamstats should be used for this (depending upon what is your current search). However, delta can be used if you query is a simple scenario like a timechart being plotted for daily span. The delta command will give you the difference of count in the current row with previous row. This way you will have a way to identify what was the previous day's total. See the following run anywhere search based on Splunk's _internal index.
index=_internal sourcetype="splunkd" log_level="WARN"
| timechart span=1d count
| delta count as Delta
| fillnull value=0 Delta
| eval Total=count-Delta
| eval percIncrDecr=(Delta/Total)*100
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This works, thank you so much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great Cheers!!! 🙂
| makeresults | eval message= "Happy Splunking!!!"
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
