https://community.splunk.com/t5/Reporting/Leaderboard-report/m-p/80985#M1833 <P>You could do this:</P> <PRE><CODE>index=_internal earliest=-1w@d latest=@d | top source | join source [search index=_internal earliest=-2w@d latest=-1w@d | top source | rename count as previous_count percent as previous_percent] | eval delta = count - previous_count </CODE></PRE> <P>Modify to fit your data and desired output.</P> Mon, 01 Apr 2013 20:29:51 GMT martin_mueller 2013-04-01T20:29:51Z https://community.splunk.com/t5/Reporting/Leaderboard-report/m-p/80984#M1832 <P>I'd like to build a leaderboard style report. I want to show the top 100 items in a list and have a column that shows the delta compared to this same time last week. Is there a plugin or some other report that makes this possible?</P> Mon, 01 Apr 2013 18:51:59 GMT https://community.splunk.com/t5/Reporting/Leaderboard-report/m-p/80984#M1832 ianmaddox4bookr 2013-04-01T18:51:59Z https://community.splunk.com/t5/Reporting/Leaderboard-report/m-p/80985#M1833 <P>You could do this:</P> <PRE><CODE>index=_internal earliest=-1w@d latest=@d | top source | join source [search index=_internal earliest=-2w@d latest=-1w@d | top source | rename count as previous_count percent as previous_percent] | eval delta = count - previous_count </CODE></PRE> <P>Modify to fit your data and desired output.</P> Mon, 01 Apr 2013 20:29:51 GMT https://community.splunk.com/t5/Reporting/Leaderboard-report/m-p/80985#M1833 martin_mueller 2013-04-01T20:29:51Z https://community.splunk.com/t5/Reporting/Leaderboard-report/m-p/80986#M1834 <P>Thanks! That was definitely the right approach. I massaged it a bit to give a delta of rankings:</P> <P><CODE>sourcetype=search earliest=-1d@d latest=@d | top search_query limit=100 | eval rank = 1 | accum rank | join search_query [search sourcetype=search earliest=-2d@d latest=-1d@d | top search_query limit=500 | eval prev_rank = 1 | accum prev_rank | rename count as prev_count percent as prev_percent] | eval delta = "+" . (prev_rank - rank) | replace "+-<EM>" with "-</EM>" in delta | replace "+0" with "--" in delta | table delta search_query count percent</CODE></P> Mon, 28 Sep 2020 13:39:04 GMT https://community.splunk.com/t5/Reporting/Leaderboard-report/m-p/80986#M1834 ianmaddox4bookr 2020-09-28T13:39:04Z