topic Need help selecting values from two events and calculating percentage change in Splunk Search

Need help selecting values from two events and calculating percentage change

jmattheson — Mon, 17 Aug 2020 16:00:58 GMT

Hello,

First of all, thanks for any help you may be able to give me. I would appreciate some help with a problem I'm having. I uploaded a csv file to my Splunk that contains only Date/Value pairs. Below is an example of the data.

I would like to select the Value of 2020-07-31 and the value of 2020-06-30 and calculate the percentage change over that month. Additionally, I'd like to be able to calculate the percentage change but I think I may be able to get that on my own if I can get a hand with the first part.

I'd share my queries so far but I wasted the whole day yesterday trying to get this to work with little useful progress.

Re: Need help selecting values from two events and calculating percentage change

vikasjha001 — Wed, 19 Aug 2020 09:44:31 GMT

Below query shall give you output of your first question. You need to use where clause in your query. Do let me know if you need more help. Hit a like answer was helpful.

index="blsi_cpi"|table Date, Value|where Date="2020-07-31" or Date="2020-06-30"

Re: Need help selecting values from two events and calculating percentage change

to4kawa — Wed, 19 Aug 2020 11:29:17 GMT

You didn't provide a calculation method, so I'm not sure.

Re: Need help selecting values from two events and calculating percentage change

jmattheson — Thu, 20 Aug 2020 18:59:03 GMT

So, I decided to fix how I ingested the data in the first place to make the Date column the timestamp. I added TIMESTAMP_FIELDS and FIELD_FORMAT to the conf file. This greatly simplified my queries. This is probably the right solution for me instead of doing something wrong and then making a convoluted workaround. Thanks for the suggestion.