topic How to compare current month count to a 3 months average? in Splunk Search

How to compare current month count to a 3 months average?

msalghamdi — Mon, 12 Jun 2023 13:29:57 GMT

Hello Splunkers.

i need your help in creating a search that would count number of values for a field in a month and then compare it to a 3months average of the same results.

thanks

Re: compare current month count to a 3months average

gcusello — Sun, 11 Jun 2023 13:47:46 GMT

Hi @msalghamdi,

only one question,: do you want to calculate the count for the current month or the last 30 days or the previous month?

because if the current month you have an incomplete count, I suppose that you want the last complete month count compared with the three months before count.

so please try this:

index=your_index earliest=-mon@mon latest=@mon | stats count AS "Current month" | append [ search index=your_index earliest=-4mon@mon latest=-3mon@mon | stats count AS "Three months ago" ] | table "Current month" "Three months ago" | eval Diff="Three months ago"-"Current month"

Ciao.

Giuseppe

Re: compare current month count to a 3months average

michael3 — Tue, 28 May 2024 12:48:29 GMT

Thank you! This was exactly what I was looking for. Much easier than trying to use eventstats