https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583828#M203316 <LI-CODE lang="markup">| bin span=1w _time | stats dc(properties.request.viewerId) as count by _time | autoregress count as previous | eval diff=previous-count | eval percent=100*diff/count</LI-CODE> Sat, 05 Feb 2022 17:34:11 GMT ITWhisperer 2022-02-05T17:34:11Z https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583663#M203249 <P>Hi folks,<BR />What query can I use to sum up my field "viewer.Id" to see how many viewers we have between 01/22/2022 and 02/02/2022. I would like to see the count of Increment/decrement from my results and also in % by comparing it with different dates.<BR /><BR />Thanks<BR />Evans</P> Fri, 04 Feb 2022 01:12:59 GMT https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583663#M203249 EvansB 2022-02-04T01:12:59Z https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583667#M203250 <P>What do your events look like?</P><P>Do you want to add up the values of viewer.id or count how many events each viewer id has or how many distinct viewer ids between those dates?</P><P>Which dates do you want to compare against?</P><P>Which increments/decrements are you trying to discover?</P> Fri, 04 Feb 2022 04:41:23 GMT https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583667#M203250 ITWhisperer 2022-02-04T04:41:23Z https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583725#M203276 <P><SPAN>Thanks for the quick turnaround,<BR /><BR />I'm hoping to perform 2 tasks<BR />1. Add up the values of viewer.id, and how many distinct viewer ids between those dates?<BR /><BR />2. I want to get the count of the total "viewer_id" for the past week against this week and compare if there were more viewers or less.<BR />I also want to get this result not only as a count but also convert (more viewers or less total count) to percentage.</SPAN></P> Fri, 04 Feb 2022 14:38:36 GMT https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583725#M203276 EvansB 2022-02-04T14:38:36Z https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583823#M203312 <P>It is still not clear what you are trying to do - your viewerId is not a number which can be added, it is a string of characters. You can however count the distinct values of viewerId or count how many times each viewerId occurs in your time period</P><LI-CODE lang="markup">| stats dc(properties.request.viewerId) | stats count by properties.request.viewerId</LI-CODE> Sat, 05 Feb 2022 16:44:15 GMT https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583823#M203312 ITWhisperer 2022-02-05T16:44:15Z https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583825#M203314 <P>You're correct,<BR />I want to get a&nbsp;count of total viewerId that occurs in my time period(past week) and compare it with another time period(this week) to see possible increase or decrease of all viewerId.&nbsp;<BR />Also, I want to convert this result into percentage.<BR />Thank you.</P> Sat, 05 Feb 2022 17:08:06 GMT https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583825#M203314 EvansB 2022-02-05T17:08:06Z https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583826#M203315 <LI-CODE lang="markup">| bin span=1w _time | stats dc(properties.request.viewerId) by _time</LI-CODE> Sat, 05 Feb 2022 17:14:49 GMT https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583826#M203315 ITWhisperer 2022-02-05T17:14:49Z https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583828#M203316 <LI-CODE lang="markup">| bin span=1w _time | stats dc(properties.request.viewerId) as count by _time | autoregress count as previous | eval diff=previous-count | eval percent=100*diff/count</LI-CODE> Sat, 05 Feb 2022 17:34:11 GMT https://community.splunk.com/t5/Splunk-Search/eval-sum-field/m-p/583828#M203316 ITWhisperer 2022-02-05T17:34:11Z