New to Splunk

Menorel — Wed, 08 Sep 2021 15:25:58 GMT

Hello All,

Been trying to get the hang of syntax within Splunk and have been able to sus out a basic understanding, true to form for myself, I usually end up jumping into the deep end when I do things, so bear with me.

I am attempting to creat a report/search/dashboard that looks over the last four hours and will display the largest percent increase of a value.

The field is BIN currently stored as a numerical value, I have tried the tostring command to transform it but usually ends up as no values being returned or them all being grouped together.

But I digress, how would I first create a search/table view that would be updated along a described timeframe lets say every hour where it looks at the previous timeframe as a percentage of total records for that timeframe and calculates the percentage increase of the two timeframes and filters to see the top 20 increases?

Example:

I would want to ignore any decreasing values and possibly only see the top 20 that had increased that are greater than or equal to a 15% increase.

BIN	Percent 2 hour ago	Percent 1 hr ago	Pecent change
123456	10%	12%	16.7%
234561	10%	8%	-25%
345612	30%	25%	-20%
456123	35%	30%	-16.7%
561234	15%	25%	40%

topic New to Splunk in Dashboards & Visualizations

New to Splunk