Splunk Search

Acquisition method of difference of count number

pipipipi
Path Finder

Hi all,

how to get difference after using chart command.

I did this command.

| eval year=strftime(X,"%y") 
| eval month=strftime(X,"%m") 
| transaction event
|chart count over year by month

it returns the table.

year    01  02  04  05  07  08  09  10  11  12  OTHER
19  2   3   37  33  14  25  30  10  32  21  8
20  9   24  3   2   1   1   22  5   55  23  7

I want to count year-over-year.
For example,
January of 19year is 2, January of 20year is 9,
so,Year-over-year increase is 9/2*100 = 450%.(it is example)

But I think I can not use delta command.
Is there any way to count year-over-year?

Thank you for helping.

0 Karma
1 Solution

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"

View solution in original post

0 Karma

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...