https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653200#M225738 <P>I am ingesting advanced hunting logs and I have a main dashboard where I present the number of events per Event Category as single numbers. I want to be able to track the changes in the number of events.</P><P>For instance, if Monday has 1,000,000 events but Tuesday has 2,000,000 events then the number of events has increased by 1,000,000.</P><P>How can I work out the difference and display this on the main dashboard.</P><P>Any help is greatly appreciated</P> Fri, 04 Aug 2023 11:51:42 GMT jhilton90 2023-08-04T11:51:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653200#M225738 <P>I am ingesting advanced hunting logs and I have a main dashboard where I present the number of events per Event Category as single numbers. I want to be able to track the changes in the number of events.</P><P>For instance, if Monday has 1,000,000 events but Tuesday has 2,000,000 events then the number of events has increased by 1,000,000.</P><P>How can I work out the difference and display this on the main dashboard.</P><P>Any help is greatly appreciated</P> Fri, 04 Aug 2023 11:51:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653200#M225738 jhilton90 2023-08-04T11:51:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653201#M225739 <P>Use streamstats to get the previous days count and subtract it from each days count.</P><LI-CODE lang="markup">| streamstats window=2 current=f last(count) as previous_count | eval change=count-previous_count</LI-CODE> Fri, 04 Aug 2023 12:01:51 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653201#M225739 ITWhisperer 2023-08-04T12:01:51Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653213#M225748 <P>Perhaps this might help actually so currently I'm ingesting advanced hunting logs into an index=advanced_hunting and within that index there is EventCategory, which has different categories such as AdvancedHunting-DeviceEvents or AdvancedHunting-DeviceFileEvents. As well as other fields like Timestamp etc</P><P>In the main dashboard, I've got a count of each of the EventCategory's which gives me the total number of events in each EventCategory, and I need to find a way to get the difference on a daily basis</P> Fri, 04 Aug 2023 13:23:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653213#M225748 jhilton90 2023-08-04T13:23:23Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653217#M225751 <P>What search do you already have? Perhaps we can build from there?</P> Fri, 04 Aug 2023 13:55:29 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653217#M225751 ITWhisperer 2023-08-04T13:55:29Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653221#M225752 <LI-CODE lang="markup">index=advanced_hunting EventCategory=AdvancedHunting-DeviceEvents | streamstats window=2 current=f last(EventCategory) as previous_count | eval change=EventCategory-previous_count</LI-CODE><P>&nbsp;</P><P>Thanks</P> Fri, 04 Aug 2023 17:30:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653221#M225752 jhilton90 2023-08-04T17:30:30Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653224#M225753 <P>OK I had assumed you already had the daily counts by EventCategory, but it appears not. Try something like this</P><LI-CODE lang="markup">index=advanced_hunting | bin _time span=1d | stats count by _time EventCategory | streamstats window=2 current=f global=f last(count) as previous_count by EventCategory | eval change=count-previous_count</LI-CODE> Fri, 04 Aug 2023 14:24:40 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653224#M225753 ITWhisperer 2023-08-04T14:24:40Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653235#M225759 <P>That's great that gives me the difference between the two days. Now I need to display it like the image&nbsp;</P> Fri, 04 Aug 2023 15:15:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653235#M225759 jhilton90 2023-08-04T15:15:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653246#M225762 <P>In that case you don't need to calculate the difference, just set the trend indicator for the single</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ITWhisperer_0-1691165988071.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26639iB5E63966BE9C2602/image-size/medium?v=v2&amp;px=400" role="button" title="ITWhisperer_0-1691165988071.png" alt="ITWhisperer_0-1691165988071.png" /></span></P><P>Although you do still need to count over time</P><LI-CODE lang="markup">index=advanced_hunting | bin _time span=1d | chart count by _time EventCategory</LI-CODE> Fri, 04 Aug 2023 16:21:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-difference-between-the-number-of-events/m-p/653246#M225762 ITWhisperer 2023-08-04T16:21:15Z