https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340318#M100932 <P>Could you go into detail about what you're seeing? Without more information, I can't tweak the search.</P> Mon, 18 Sep 2017 14:48:57 GMT jluo_splunk 2017-09-18T14:48:57Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340315#M100929 <P>I have event data in below format:</P> <PRE><CODE>Sep 15 2017 07:06:07 app=yahoo dataconsumed=50 Sep 15 2017 08:16:07 app=skype dataconsumed=150 Sep 14 2017 10:26:07 app=facebook dataconsumed=10 Sep 14 2017 12:26:07 app=facebook dataconsumed=5 Sep 13 2017 7:26:07 app=yahoo dataconsumed=10 Sep 13 2017 9:26:07 app=skype dataconsumed=50 Sep 12 2017 3:26:07 app=facebook dataconsumed=80 Sep 12 2017 1:26:07 app=facebook dataconsumed=0 </CODE></PRE> <P>How should I perform the following tasks:</P> <OL> <LI>For any given time range, search and split the events in to two halves of "day" or "hours" i.e if "All Time" is selected as time range using Time Picker, I should be able to split above events into two halves by day(firsthalf=sep15-sep14 and secondhalf=sep 13-sep12) or by hour(firsthalf=48hour secondhalf=48hour).</LI> <LI><P>Then after splitting events into two halves, I must sum dataconsumed by app in both halves(events split by time) i.e</P> <H2>time app total_dataconsumed</H2> <P>firsthalf yahoo 50<BR /> skype 150</P> <H2> facebook 15</H2> <P>secondhalf yahoo 10<BR /> skype 50<BR /> facebook 80</P></LI> <LI><P>Find difference between total_dataconsumed by app using firsthalf and secondhalf i.e firsthalf - secindhalf</P> <H2>app difference</H2> <P>yahoo 40<BR /> skype 100<BR /> facebook -65</P></LI> </OL> <P>I am still stuck on step 1, I don't seem to understand how should one split the search events into halves/spans and apply stats on both halves?</P> Fri, 15 Sep 2017 21:13:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340315#M100929 sohaibomar 2017-09-15T21:13:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340316#M100930 <P>There may be an easier way to do this, but you could try..</P> <PRE><CODE>| eventstats min(_time) as startTime, range(_time) as timeElapsed | eval halfwayMark=startTime+(timeElapsed/2) | eval series=if(_time&lt;halfwayMark, "firstHalf", "secondHalf") | chart sum(usage) by app, series | eval diff=firstHalf-secondHalf </CODE></PRE> Fri, 15 Sep 2017 23:08:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340316#M100930 jluo_splunk 2017-09-15T23:08:18Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340317#M100931 <P>Thanks @jluo [Splunk], but I still can not get a difference between both halves.<BR /> ...|eval diff=firstHalf-secondHalf does not do anything.</P> Sat, 16 Sep 2017 09:25:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340317#M100931 sohaibomar 2017-09-16T09:25:16Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340318#M100932 <P>Could you go into detail about what you're seeing? Without more information, I can't tweak the search.</P> Mon, 18 Sep 2017 14:48:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340318#M100932 jluo_splunk 2017-09-18T14:48:57Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340319#M100933 <P>Try this:</P> <PRE><CODE>Your Base Search Here | addinfo | eval time=if((_time &lt;= (now()-(if(isnum(info_max_time), info_max_time, now()) - info_min_time)/2)), "firsthalf", "secondhalf") | stats sum(dataconsumed) AS total_dataconsumed BY app time </CODE></PRE> Sat, 25 Nov 2017 19:22:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-field-total-over-time/m-p/340319#M100933 woodcock 2017-11-25T19:22:07Z