https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398513#M115572 <P>In the search below I have appended two identical searches that are 1 week apart. <BR /> I would like to find the difference in percent between the two over time. <BR /> I am aware of the <CODE>timewrap</CODE> function but that's not exactly sure how it could help here. <BR /> A <CODE>timechart</CODE> of percentage difference would be ideal.</P> <PRE><CODE>index="blah" earliest=-192h latest=-168h | setfields when='1 week ago' | eval _time = _time+604800 | append [search index="blah" earliest=-24h latest=now | setfields when='0 week ago'] </CODE></PRE> Tue, 28 May 2019 20:16:51 GMT pr0n 2019-05-28T20:16:51Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398513#M115572 <P>In the search below I have appended two identical searches that are 1 week apart. <BR /> I would like to find the difference in percent between the two over time. <BR /> I am aware of the <CODE>timewrap</CODE> function but that's not exactly sure how it could help here. <BR /> A <CODE>timechart</CODE> of percentage difference would be ideal.</P> <PRE><CODE>index="blah" earliest=-192h latest=-168h | setfields when='1 week ago' | eval _time = _time+604800 | append [search index="blah" earliest=-24h latest=now | setfields when='0 week ago'] </CODE></PRE> Tue, 28 May 2019 20:16:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398513#M115572 pr0n 2019-05-28T20:16:51Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398514#M115573 <P>@pr0n you can try the following:</P> <PRE><CODE> &lt;yourCurrentSearch&gt; | timechart count by when | eval "diff %"=round((('0 week ago'-'1 week ago')/'0 week ago')*100,2) | fillnull "diff %" value=0 </CODE></PRE> <P>Once you have <CODE>diff %</CODE> you can create a chart overlay to plot it on top of your existing output.</P> <P>However, at the same time since append will run into sub-search limitation, you can try the <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multisearch#Subsearch_processing_and_limitations">multisearch</A> command instead. Following is a run anywhere search based on Splunk's _internal index.</P> <PRE><CODE>| multisearch [ search index="_internal" earliest=-192h latest=-168h | setfields when="1 week ago" | eval _time = _time+604800] [ search index="_internal" earliest=-24h latest=now | setfields when="0 week ago"] | timechart count by when | eval "diff %"=round((('0 week ago'-'1 week ago')/'0 week ago')*100,2) | fillnull "diff %" value=0 </CODE></PRE> Wed, 29 May 2019 03:27:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398514#M115573 niketn 2019-05-29T03:27:21Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398515#M115574 <P>"diff %" ends up being null (and thus 0) when I attempt your top method. After experimenting it seems that '0 week ago' and '1 week ago' don't reference anything. Unfortunately I don't have the ability to query our _internal index but I think I can structure this to keep it under 10k. </P> Wed, 29 May 2019 15:58:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398515#M115574 pr0n 2019-05-29T15:58:25Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398516#M115575 <PRE><CODE>index="blah" earliest=-169h latest=-168h | timechart count AS count_1weekago | appendcols [search index="blah" earliest=-1h latest=now | timechart count AS count_now] | eval DiffPercent = (count_now - count_1weekago) / count_1weekago * 100 </CODE></PRE> <P>This is what worked.</P> Wed, 29 May 2019 17:10:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398516#M115575 pr0n 2019-05-29T17:10:30Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398517#M115576 <P>@pr0n if you have null values for current week and/or previous week, you can get null for diff% and hence 0, which is expected. Do accept the answer if you found this helpful.</P> Wed, 29 May 2019 17:51:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398517#M115576 niketn 2019-05-29T17:51:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398518#M115577 <P>Null is not expected, there are definitely values there. I have made an answer post which was my solution.</P> Wed, 29 May 2019 17:58:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-the-percentage-difference/m-p/398518#M115577 pr0n 2019-05-29T17:58:29Z