topic Re: How to show Trending compared to last month value in Splunk Search

How to show Trending compared to last month value

avni26 — Wed, 30 Sep 2020 02:19:40 GMT

Hello ,
I want to show trending compared to last score calculated.
I have multiple single panels calculating one field "score"for last month(August) based on some condition like last_month_count(August count) > last2_month (july count)
and taking summation of all panel's result value in another dashboard Panel as total_score
Now, I want to show trending compared to last total_ score to this month total_score.
Please suggest ,how to approach for the same.
Thanks.

Re: How to show Trending compared to last month value

richgalloway — Mon, 23 Sep 2019 13:55:28 GMT

Have you looked at the timewrap command?

Re: How to show Trending compared to last month value

avni26 — Mon, 23 Sep 2019 14:28:32 GMT

yes, timewrap will not work in my query , as for each panel , i am just searching for last month.
Any other way?

Re: How to show Trending compared to last month value

DavidHourani — Mon, 23 Sep 2019 14:44:24 GMT

Hi @avni26,

As Rich suggested you can do this using timewrap whoever if that doesn't work for you then you can use append instead to build your search as shown in the first answer here :
https://answers.splunk.com/answers/371015/display-comparison-between-last-week-vs-this-week.html

Let me know what your search looks like if the above link didn't work for you so we can try and fix it.

Cheers,
David

Re: How to show Trending compared to last month value

avni26 — Mon, 23 Sep 2019 18:29:27 GMT

@DavidHourani , yes append only do. But my query is already too long and also have several panel's each having their independent index . By append ,I have to write all query again for last month. 😞
I guess, i have to use report for the same.

Re: How to show Trending compared to last month value

DavidHourani — Tue, 24 Sep 2019 03:49:22 GMT

How about using an eval to create a field containing "Current Month" and "last Month" based on the time and then run a timechart by that field ?

Re: How to show Trending compared to last month value

avni26 — Tue, 24 Sep 2019 07:12:00 GMT

@DavidHourani yes, this can be perfect. Please share any sample query for more understanding. If possible.