https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349064#M174865 <P>This works, thank you so much!</P> Wed, 26 Apr 2017 07:56:31 GMT allansneddon 2017-04-26T07:56:31Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349062#M174863 <P>Hi guys, </P> <P>I create daily reports with various data on that we collect, and i am now looking to add a few extra bits of information that will be useful to the team.<BR /> I am looking to create a chart that show the % difference from the today's data against the data received the day before. For example if we received 100 events yesterday and 200 today it shows an increase of 100%. Any help would be very much appreciated. </P> <P>Cheers,</P> <P>Allan</P> Tue, 25 Apr 2017 08:22:58 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349062#M174863 allansneddon 2017-04-25T08:22:58Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349063#M174864 <P>Ideally, <STRONG>streamstats</STRONG> should be used for this (depending upon what is your current search). However, <STRONG>delta</STRONG> can be used if you query is a simple scenario like a timechart being plotted for daily span. The delta command will give you the difference of count in the current row with previous row. This way you will have a way to identify what was the previous day's total. See the following run anywhere search based on Splunk's _internal index.</P> <PRE><CODE>index=_internal sourcetype="splunkd" log_level="WARN" | timechart span=1d count | delta count as Delta | fillnull value=0 Delta | eval Total=count-Delta | eval percIncrDecr=(Delta/Total)*100 </CODE></PRE> Tue, 25 Apr 2017 13:58:53 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349063#M174864 niketn 2017-04-25T13:58:53Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349064#M174865 <P>This works, thank you so much!</P> Wed, 26 Apr 2017 07:56:31 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349064#M174865 allansneddon 2017-04-26T07:56:31Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349065#M174866 <P>Great Cheers!!! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 27 Apr 2017 14:14:51 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-Difference/m-p/349065#M174866 niketn 2017-04-27T14:14:51Z