Splunk Search

Acquisition method of difference of count number

pipipipi
Path Finder

Hi all,

how to get difference after using chart command.

I did this command.

| eval year=strftime(X,"%y") 
| eval month=strftime(X,"%m") 
| transaction event
|chart count over year by month

it returns the table.

year    01  02  04  05  07  08  09  10  11  12  OTHER
19  2   3   37  33  14  25  30  10  32  21  8
20  9   24  3   2   1   1   22  5   55  23  7

I want to count year-over-year.
For example,
January of 19year is 2, January of 20year is 9,
so,Year-over-year increase is 9/2*100 = 450%.(it is example)

But I think I can not use delta command.
Is there any way to count year-over-year?

Thank you for helping.

0 Karma
1 Solution

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"

View solution in original post

0 Karma

anmolpatel
Builder

Like this:

#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...