Splunk Search

Acquisition method of difference of count number

pipipipi
Path Finder

Hi all,

how to get difference after using chart command.

I did this command.

| eval year=strftime(X,"%y") 
| eval month=strftime(X,"%m") 
| transaction event
|chart count over year by month

it returns the table.

year    01  02  04  05  07  08  09  10  11  12  OTHER
19  2   3   37  33  14  25  30  10  32  21  8
20  9   24  3   2   1   1   22  5   55  23  7

I want to count year-over-year.
For example,
January of 19year is 2, January of 20year is 9,
so,Year-over-year increase is 9/2*100 = 450%.(it is example)

But I think I can not use delta command.
Is there any way to count year-over-year?

Thank you for helping.

0 Karma
1 Solution

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"

View solution in original post

0 Karma

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...