I have the following search command defined by a custom time range (last 2 weeks):
index=mlr3_google sourcetype=mlr3_google_ext | bucket span=1w _time | eval Date=strftime(_time,"%m-%d-%y") | chart sum(uniqueVisitors) over sourcetype by Date
I want to calculate the percentage change for this week from last week.
How do I calculate that?
You probably want to do smth like this:
index=mlr3_google sourcetype=mlr3_google_ext | eval Date=if(_time>relative_time(now(),"-1w"),"this_week","last_week") | chart sum(uniqueVisitors) as count over sourcetype by Date | eval change_pct=if(last_week==0,"-",if((this_week-last_week)>0,"+","")+tostring(round((this_week-last_week)/last_week*100,1))+"%") | table sourcetype last_week this_week change_pct | rename last_week as "Last week" this_week as "This week" change_pct as "Change in %"
Specifying the time range actually solves the problem! Thanks so much for your help!!
Thank you for the response however I noticed that the value for 'last week' is summing all previous weeks instead of taking the value of only 'last week'. How can I modify your command to only calculate only 7 days last week?