topic Re: Diff and % calculation 1st row vs 2nd row in Splunk Search

Diff and % calculation 1st row vs 2nd row

puneethgowda — Tue, 29 Sep 2020 11:53:31 GMT

source=DAM_DB_SUMMARY_REPORT | eval Date=substr(DATES,1,10) | stats sum(TOTAL_RECORDS) as "Total Records" by Date | sort - Date

i would like to insert one column that should be DIFF and calculation should be subtraction ( Row 1 - row 2) row 1 value us 797,775 and row 2 value is 797,774 so 3rd new column value should be 1. and also we need % in 3rd column 1/797,775 (diff/1st row count)

Re: Diff and % calculation 1st row vs 2nd row

Richfez — Fri, 18 Nov 2016 12:26:02 GMT

I thought this for sure was going to be a streamstats answer, but instead it's far easier to use delta.

You should be able to just add | delta "Total Records" to the end of your search, like

source=DAM_DB_SUMMARY_REPORT | eval Date=substr(DATES,1,10) | stats sum(TOTAL_RECORDS) as "Total Records" by Date | sort - Date | delta "Total Records"

Can you give that a go and report back?

Happy Splunking!
Rich

Re: Diff and % calculation 1st row vs 2nd row

puneethgowda — Fri, 18 Nov 2016 12:27:59 GMT

sorry it was very simple i have got this after posting here forgot to upfdate

Re: Diff and % calculation 1st row vs 2nd row

puneethgowda — Fri, 18 Nov 2016 12:28:45 GMT

thanks a lot