topic Re: Trending sum count in Splunk Search

Trending sum count

munisb — Wed, 07 Oct 2020 23:15:40 GMT

Hi,

I am trying to create a trending single value however having trouble setting it up. Essentially the stats below sums up VALUE_NUM and works as expected however i would like to compare this to 7d period or with the same previous_value of the time-picker

index=main VALUE_NUM>0 | dedup UUID | stats sum(VALUE_NUM)

I have tried

index=main VALUE_NUM>0 | dedup UUID | timechart count as sum(VALUE_NUM) span=7d

however this isn't returning the correct value

TIA

Re: Trending sum count

bowesmana — Wed, 07 Oct 2020 23:57:49 GMT

With a single value visualisation, you can add a trend sparkline showing the comparison against earlier, but you need to use timechart

index=main VALUE_NUM>0 | dedup UUID | timechart span=1d sum(VALUE_NUM)

and then in the format section of the single value viz, set these

Hope this helps

Another command you can use is timewrap, which can then show corresponding time periods mapped onto the same chart period

Re: Trending sum count

munisb — Thu, 08 Oct 2020 01:04:55 GMT

Thank you. Close however the numbers aren't adding up.

So for instance: if run stats sum - the total count comes to over 2000. This is the sum of the values in VALUE_NUM. There are multiple events that has VALUE_NUM with the value greater than 0.

whereas with Timechart - it comes to about 300 (missing 1700)

These events are usually populated during the weekends and some (small amount of events) come during the day. So the sum of VALUE_NUM over 7 days = 2000; and comparing it to the past 7 days of the sum would be ideal.

ex:

Sum of Week1=2500

Sum of Week2=1800

Sum of Week3=2000

So trendline for Week3 would show an uptick of 200 and the count as 2000