Splunk Search

How can I compare data between two dates?

kennethyeung
New Member

I have index data like below, and I want to calculate how many have a stock price higher than yesterday.
date, stock, price
20171016, abc, 100
20171016, def, 80
20171015, abc,120
20171015, def, 60
20171014, abc, 100
20171014, def, 70

My search can do that, but is any other better search to do it as well
index=test
| eval nexttime=strftime(relative_time(now(),"-2d") ,"%Y%m%d")

| table *
| where 'date' >= nexttime
| eventstats avg(close) as aa by code
| eval updown = if((close > aa), 1,0)
| table * | where 'date' > nexttime
| addcoltotals
| tail 1| table updown

Also, if i want to do similar function for last 7 day, how can i do it?

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

(your search)
|table date,stock,price
|sort stock,date
|streamstats count by stock
|delta price as diff_price
|eval diff_price=if(count=1,0,diff_price)

View solution in original post

0 Karma

HiroshiSatoh
Champion

Try this!

(your search)
|table date,stock,price
|sort stock,date
|streamstats count by stock
|delta price as diff_price
|eval diff_price=if(count=1,0,diff_price)

0 Karma

kennethyeung
New Member

yes, it work and better than my search.

but how can i group by date to show how many stock up and down
after your search, if i want to use transaction date , it will so no result found.

0 Karma

HiroshiSatoh
Champion

Please tell me the output image.

0 Karma

kennethyeung
New Member

i want some thing like below

date, number of stock raise
20171016 , 1
20171015,1

0 Karma

HiroshiSatoh
Champion

Should diff_price count the plus?

|stats count(eval(diff_price>0)) as updown by date

0 Karma

kennethyeung
New Member

thanks it work as what i want, let me spend some time to play with those syntax, i am newbies in splunk

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...