topic Re: To show the difference for two values in timechart Splunk in Dashboards & Visualizations

To show the difference for two values in timechart Splunk

Raja_Selvaraj — Tue, 25 Feb 2025 16:00:04 GMT

Hi Everyone,

Can someone please help me with Splunk query to show difference of two values in timechart for the period of time. The sample result which i get from the query with Column A with time range and other columns with the respective host values.

Column A Column B Column C Column D

02/22/2025 10 12 14
02/23/2025 11 13 15

02/24/2025 12 15 17
02/25/2025 16 20 21

I need the difference of values of Column B C D from previous time period and show it one time chart. Let me know if any other details are required.

Re: To show the difference for two values in timechart Splunk

gcusello — Tue, 25 Feb 2025 16:09:01 GMT

Hi @Raja_Selvaraj ,

use delta command ( https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Delta ).

Ciao.

Giuseppe

Re: To show the difference for two values in timechart Splunk

Raja_Selvaraj — Tue, 25 Feb 2025 18:13:28 GMT

Hello Giuseppe,

Thanks for the reply, but when my data looks like this (shared in screenshot) and how do we compare difference with current date values & previous date values for each host values and show it as timechart series:-

my query ends with:-

| timechart span=1d avg(File_Total) by HOST

Re: To show the difference for two values in timechart Splunk

gcusello — Wed, 26 Feb 2025 13:38:07 GMT

Hi @Raja_Selvaraj ,

if you know the names of the host you can follow my solution.

Cisao.

Giuseppe

Re: To show the difference for two values in timechart Splunk

Raja_Selvaraj — Wed, 26 Feb 2025 16:47:25 GMT

Hi @gcusello ,

There are many host names like more than 80 host names from the mentioned search results.

Re: To show the difference for two values in timechart Splunk

gcusello — Thu, 27 Feb 2025 07:17:32 GMT

Hi @Raja_Selvaraj ,

if you have more than 80 columns, how do you think that you can read 80 columns of values plus 80 columnd of differences from the previous values, it's anyway unreadable!

Maybe you should think a different visualization!

Anyway, you could use something like this:

Ciao.

Giuseppe