Splunk Search

Acquisition method of difference of count number

pipipipi
Path Finder

Hi all,

how to get difference after using chart command.

I did this command.

| eval year=strftime(X,"%y") 
| eval month=strftime(X,"%m") 
| transaction event
|chart count over year by month

it returns the table.

year    01  02  04  05  07  08  09  10  11  12  OTHER
19  2   3   37  33  14  25  30  10  32  21  8
20  9   24  3   2   1   1   22  5   55  23  7

I want to count year-over-year.
For example,
January of 19year is 2, January of 20year is 9,
so,Year-over-year increase is 9/2*100 = 450%.(it is example)

But I think I can not use delta command.
Is there any way to count year-over-year?

Thank you for helping.

0 Karma
1 Solution

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"

View solution in original post

0 Karma

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"
0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...