topic Re: Need to compare the last hour values of the fields with current one hour in Splunk Search https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476181#M192628 <P>Hi kartm,<BR /> did you explored the timewrap command? ( <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Timewrap">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Timewrap</A> )</P> <PRE><CODE>your_search | timechart count span=1h | timewrap 1hour </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 12 Sep 2019 17:59:13 GMT gcusello 2019-09-12T17:59:13Z Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476180#M192627 <P>Hi,<BR /> We are monitoring the transaction count. I need to verify the results of last one hour, if there is any decrease in the count the alert needs to be generated.<BR /> For example :<BR /> 7 AM to 8 AM - transaction count with fields<BR /> 8 AM to 9 AM - I need to verify the fields values with 7AM to 8AM field values. If the count get decreased alerts needs to notified.<BR /> How to write the search for this scenario.?<BR /> Please suggest</P> Thu, 12 Sep 2019 14:08:01 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476180#M192627 kartm2020 2019-09-12T14:08:01Z Re: Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476181#M192628 <P>Hi kartm,<BR /> did you explored the timewrap command? ( <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Timewrap">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Timewrap</A> )</P> <PRE><CODE>your_search | timechart count span=1h | timewrap 1hour </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 12 Sep 2019 17:59:13 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476181#M192628 gcusello 2019-09-12T17:59:13Z Re: Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476182#M192629 <P>Great. Thank you. How can i compare the fields values with 1hour_before with latest fields values</P> Fri, 13 Sep 2019 05:39:00 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476182#M192629 kartm2020 2019-09-13T05:39:00Z Re: Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476183#M192630 <P>Hi kartm,<BR /> if this answer satisfies your need, please, accept and/or upvote it.<BR /> Bye, see next time.<BR /> Giuseppe</P> Fri, 13 Sep 2019 06:58:00 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476183#M192630 gcusello 2019-09-13T06:58:00Z Re: Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476184#M192631 <P>How can i compare the fields values with 1hour_before with latest fields values</P> Fri, 13 Sep 2019 09:32:15 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476184#M192631 kartm2020 2019-09-13T09:32:15Z Re: Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476185#M192632 <P>try something like this:<BR /> you must adapt your search creating something like this</P> <PRE><CODE>index=_internal earliest=-3h@h latest=-h@h | timechart count | timewrap 1h </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 13 Sep 2019 10:20:25 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476185#M192632 gcusello 2019-09-13T10:20:25Z Re: Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476186#M192633 <P>Hi Giuseppe,<BR /> It is giving the expected result. But i need the difference the two fields and results should be in the third field as a percentage.</P> Fri, 13 Sep 2019 10:26:34 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476186#M192633 kartm2020 2019-09-13T10:26:34Z Re: Need to compare the last hour values of the fields with current one hour https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476187#M192634 <P>Try this</P> <PRE><CODE>index=_internal | timechart span=1h count | delta count AS Delta | eval deltaPerc=Delta/count*100 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 13 Sep 2019 10:36:42 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-compare-the-last-hour-values-of-the-fields-with-current/m-p/476187#M192634 gcusello 2019-09-13T10:36:42Z