Splunk Search

Percentage difference between two successive events as a new field

rturk
Builder

So a quick and dirty one.

If I have a search that gives me a daily summary of the bytes downloaded by web users:

sourcetype="web_logs" | timechart span=1d sum(sc_bytes) AS "Daily Traffic (Bytes)"

What would be the best way to compare two successive days and give a % increase/decrease value? e.g.

_time                      Daily Traffic    perc_diff
8/9/11  12:00:00.000 AM    318606425        0
8/10/11 12:00:00.000 AM    66560892         -79.10
8/11/11 12:00:00.000 AM    2987269232       4388.02
8/12/11 12:00:00.000 AM    7981047          -99.73
8/13/11 12:00:00.000 AM    160388640        1909.61 
8/14/11 12:00:00.000 AM    52523918         -67.25

Hope someone can help.. I have Splunkers block 😛

Tags (3)
1 Solution

echalex
Builder

Hi R.Turk,

I think you should be succesful using bucket, delta and eval. Use bucket to group the results into daily sets, stats to calculate the daily sum, delta to calculate the change and eval to get the percentage.

...|bucket _time span=1d | stats sum(sc_bytes) as sc_bytes_daily by _time |delta sc_bytes_daily as change |eval change_percent=change/(sc_bytes_daily-change)*100 |timechart span=1d  first(sc_bytes_daily) AS "Daily traffic (bytes)", first(change_percent) AS "Change (%)"

HTH

View solution in original post

echalex
Builder

Hi R.Turk,

I think you should be succesful using bucket, delta and eval. Use bucket to group the results into daily sets, stats to calculate the daily sum, delta to calculate the change and eval to get the percentage.

...|bucket _time span=1d | stats sum(sc_bytes) as sc_bytes_daily by _time |delta sc_bytes_daily as change |eval change_percent=change/(sc_bytes_daily-change)*100 |timechart span=1d  first(sc_bytes_daily) AS "Daily traffic (bytes)", first(change_percent) AS "Change (%)"

HTH

kristian_kolb
Ultra Champion

Well done! I was playing with an alternate solution, but not using bucket - noticed that bucket reduced the memory used during the search by a factor of 3 in my case. The job runtimes were similar for both searches. K.

0 Karma

echalex
Builder

:blush: You noticed! Yep, I did some testing with 5m buckets.

And yes, I'll be there. Looking forward to that beer! 🙂

0 Karma

rturk
Builder

Thanks echalex! That's exactly what I was after! I was going to ask you why the 5 minute spans, but you edited it 🙂 If you're heading to .conf2012, I'll be sure to buy you a beer 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...