topic Re: Calculate total count difference per day in Splunk Search

Calculate total count difference per day

Sfry1981 — Wed, 29 Apr 2020 14:50:42 GMT

I have a set of data like the below

total=2000
date=2020-04-29

total=1975
date=2020-04-28

total=1951
date=2020-04-27

What I want to produce is a chart that shows the difference per day of these totals i.e as per the below

total difference = 25
date=2020-04-29

total difference=24
date=2020-04-28

total=33
date=2020-04-27

etc

I need a calculation of the difference per day

my raw data already has the total and date in so its a straight calculation from that data

Re: Calculate total count difference per day

kamlesh_vaghela — Wed, 29 Apr 2020 15:00:56 GMT

@Sfry1981

Can you please try this?

YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff

Sample Search:

| makeresults | eval  total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff

Just change search as per your requirement.

Re: Calculate total count difference per day

Sfry1981 — Wed, 29 Apr 2020 15:11:36 GMT

@kamlesh_vaghela

As the date was in a string format i removed "eval t=strptime(date,"%Y-%m-%d")" and then it worked. Thanks 🙂

Re: Calculate total count difference per day

kamlesh_vaghela — Wed, 29 Apr 2020 15:24:12 GMT

cool @Sfry1981

Glad to help you

Re: Calculate total count difference per day

Sfry1981 — Wed, 29 Apr 2020 15:34:09 GMT

@kamlesh_vaghela i have 1 issue. It shows all the previous figures as minus so it inverts the graphs but i want them to show as positives. I tried "| eval mynum=abs(mynum)" but this doesnt work. Do you know how to amend?

Re: Calculate total count difference per day

kamlesh_vaghela — Thu, 30 Apr 2020 04:54:38 GMT

@Sfry1981

| eval mynum=abs(mynum) should work.

Can you please share your sample search and sample value you getting in mynum?

Re: Calculate total count difference per day

Sfry1981 — Thu, 30 Apr 2020 07:20:23 GMT

sorry @kamlesh_vaghela It was my mistake, where i was charting i was using the incorrect value. School boy error. All working again. Thanks for all your help.