https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-change-over-selectable-timerange/m-p/693749#M236005 <P>Hello</P> <P>&nbsp;</P> <P>I'd like to create a single value viz that displays the percent change from a pint in time to now. Basically, I have a dashboard that has a panel that simply counts the number of records in the given timerange. The time is a simple time picker and the base search is a simple:</P> <LI-CODE lang="markup">index=myindex | stats count</LI-CODE> <P><BR /><BR />I would like to add a panel, maybe single viz, that shows a percent change. For example, if the default is "Last 24 hours" I would like to show the count of the last 24 hours and the percent change from the previous 24 hours. Additionally, if the user selected "Last 7 days" i would like it to give the count of the last 7 days and the percent change from 7 days before that.<BR /><BR /></P> <P>&nbsp;</P> <P>Thanks for the help</P> Thu, 18 Jul 2024 15:56:41 GMT tkwaller_2 2024-07-18T15:56:41Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-change-over-selectable-timerange/m-p/693749#M236005 <P>Hello</P> <P>&nbsp;</P> <P>I'd like to create a single value viz that displays the percent change from a pint in time to now. Basically, I have a dashboard that has a panel that simply counts the number of records in the given timerange. The time is a simple time picker and the base search is a simple:</P> <LI-CODE lang="markup">index=myindex | stats count</LI-CODE> <P><BR /><BR />I would like to add a panel, maybe single viz, that shows a percent change. For example, if the default is "Last 24 hours" I would like to show the count of the last 24 hours and the percent change from the previous 24 hours. Additionally, if the user selected "Last 7 days" i would like it to give the count of the last 7 days and the percent change from 7 days before that.<BR /><BR /></P> <P>&nbsp;</P> <P>Thanks for the help</P> Thu, 18 Jul 2024 15:56:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-change-over-selectable-timerange/m-p/693749#M236005 tkwaller_2 2024-07-18T15:56:41Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-change-over-selectable-timerange/m-p/693757#M236007 <P>Make your selector token "24hour", "7day", etc. Let's call it $span_tok$. This should do.</P><LI-CODE lang="markup">index=myindex earliest=-$span_tok$-$span_tok$ | timechart span=$span_tok$ count | streamstats delta(count) as pct_change | eval pct_change = pct_change / (count - pct_change) * 100</LI-CODE><P>The idea is simple, look back 2x $span_tok$, then calculate delta on the go.&nbsp;</P> Thu, 18 Jul 2024 16:14:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-change-over-selectable-timerange/m-p/693757#M236007 yuanliu 2024-07-18T16:14:59Z