https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362077#M39812 <P>This technically works for me and is what I was looking for. But the time period is actually not a standard 4 weeks duration. The end user can change it to any duration. <BR /> Is it possible to incorporate dynamic weeknum too?</P> Mon, 19 Mar 2018 09:13:34 GMT rajashekar_s 2018-03-19T09:13:34Z https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362075#M39810 <P>I am looking for a way to find the difference between two columns which are dynamic in values(time based).<BR /> Here is how the query looks like-<BR /> index=_internal<BR /> | eval weeknum=strftime(time_field,"%Y-%V")<BR /> | chart count over sourcetype by weeknum<BR /> | addtotals 2*<BR /> | sort- Total<BR /> | head 4</P> <P>Sample table<BR /> sourcetype 2018-03 2018-04 2018-05 2018-06 Total<BR /> a 2 3 4 5 14<BR /> b 2 1 3 5 11<BR /> c 0 0 4 5 9<BR /> d 1 1 2 3 7</P> <P>I am looking to calculate the difference between column 2 (2018-03) and column 5 (2018-06). <BR /> As the time picker can be given with any input, the weeknum is dynamic and I need the way to calculate difference with the dynamic names of the column.</P> Tue, 29 Sep 2020 18:33:39 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362075#M39810 rajashekar_s 2020-09-29T18:33:39Z https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362076#M39811 <P>Try this alternate implementation (Try to add one line at a time to your search to understand query functionality)</P> <PRE><CODE>index=_internal | eval weeknum=strftime(time_field,"%Y-%V") | stats count by sourcetype weeknum | streamstats count as sno by sourcetype | appendpipe [| where sno=1 OR sno=4| chart values(count) over sourcetype by sno | eval count='1'-'4' | eval weeknum="Change" | table sourcetype weeknum count ] | xyseries sourcetype weeknum count | addtotals 2* </CODE></PRE> Fri, 16 Mar 2018 18:58:15 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362076#M39811 somesoni2 2018-03-16T18:58:15Z https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362077#M39812 <P>This technically works for me and is what I was looking for. But the time period is actually not a standard 4 weeks duration. The end user can change it to any duration. <BR /> Is it possible to incorporate dynamic weeknum too?</P> Mon, 19 Mar 2018 09:13:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362077#M39812 rajashekar_s 2018-03-19T09:13:34Z https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362078#M39813 <P>Assuming you always want difference of first weeknum and last (recent) weeknum, so try this variation:</P> <PRE><CODE>index=_internal | eval weeknum=strftime(time_field,"%Y-%V") | stats count by sourcetype weeknum | streamstats count as sno by sourcetype | eventstats max(sno) as max by sourcetype | appendpipe [| where sno=1 OR sno=max | eval sno=if(sno=1,"first","recent") | chart values(count) over sourcetype by sno | eval count='first'-'recent' | eval weeknum="Change" | table sourcetype weeknum count ] | xyseries sourcetype weeknum count | addtotals 2* </CODE></PRE> Mon, 19 Mar 2018 16:33:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362078#M39813 somesoni2 2018-03-19T16:33:17Z https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362079#M39814 <P>That worked. Thanks a lot</P> Tue, 20 Mar 2018 07:37:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Difference-of-two-columns-with-dynamic-names/m-p/362079#M39814 rajashekar_s 2018-03-20T07:37:18Z