topic Re: Calculate percentage increase/reduction in Splunk Search

Calculate percentage increase/reduction

superisk — Wed, 20 Jan 2021 17:25:08 GMT

Hello,

I have calculated my Total Escalations per Quarter using stats count and I would like to include another field to calculate the percentage increase/decrease of Total Escalations per Quarter.

My query -

| inputlookup Case_Database_v2.csv
| rename "Case Number" AS Case_Number
| search Role=Support Squad=*CMS*
| lookup EAS_Escalations_v1.csv "Case Number" AS Case_Number OUTPUTNEW "Case Number"
| rename "Case Number" AS EAS_Case_Number
| eventstats dc(Case_Number) as CaseCount by Quarter
| stats count(EAS_Case_Number) as Total_Escalations by Quarter, CaseCount
| eval EAS_Escalation(Percentage)=round(Distinct_Escalations/CaseCount*100,2)

And this shows -


Quarter	CaseCount	Total Escalations
Qtr 1	799	315
Qtr 2	889	368
Qtr 3	798	287
Qtr 4	777	220

I would like to calculate the percentage reduction per quarter, for example, Qtr 4 Total Escalations of 220 is a 13.5% reduction on the 287 escalations from Qtr 3.

Any help is much appreciated!

Re: Calculate percentage increase/reduction

richgalloway — Wed, 20 Jan 2021 18:24:31 GMT

Streamstats should do it.

| inputlookup Case_Database_v2.csv | rename "Case Number" AS Case_Number | search Role=Support Squad=*CMS* | lookup EAS_Escalations_v1.csv "Case Number" AS Case_Number OUTPUTNEW "Case Number" | rename "Case Number" AS EAS_Case_Number | eventstats dc(Case_Number) as CaseCount by Quarter | stats count(EAS_Case_Number) as Total_Escalations by Quarter, CaseCount | eval EAS_Escalation(Percentage)=round(Distinct_Escalations/CaseCount*100,2) | streamstats window=2 range(Total_Escalations) as Diff

Re: Calculate percentage increase/reduction

superisk — Wed, 20 Jan 2021 19:43:09 GMT

Thank you kindly!