topic Re: To compare the value of particular day with the same day of the last week and last to last week. in Splunk Search https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701411#M237923 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR />As&nbsp;CurrentWeek* is calculated dynamically , how can i put that field in the table command.&nbsp;<BR />If i use the below table command , it shows me the result in the same order.&nbsp;<BR />How can i reverse the order of the&nbsp;CurrentWeek columns ???&nbsp;<BR /><BR />| table A B C DAY_OF_WEEK Start_Time CurrentWeek*&nbsp;Deviation<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Real_captain_0-1728475312762.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33022i9450FB278D0A172A/image-size/medium?v=v2&amp;px=400" role="button" title="Real_captain_0-1728475312762.png" alt="Real_captain_0-1728475312762.png" /></span></P><P>&nbsp;</P> Wed, 09 Oct 2024 12:02:00 GMT Real_captain 2024-10-09T12:02:00Z To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701301#M237901 <P>Hi&nbsp;<BR />Can someone please tell me how we can compare the value of a particular day with the value of the same day of last week and create a new field as deviation.&nbsp;</P><P>Example :&nbsp;<BR />Below command generates the output as below :&nbsp;<BR /><BR />| stats sum(Number_Events) as TOTAL by FIeld1 FIeld2&nbsp; FIeld3 Day&nbsp; Time Week_of_year Total</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Real_captain_3-1728394005350.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32997i3C9BC52FF6188763/image-size/medium?v=v2&amp;px=400" role="button" title="Real_captain_3-1728394005350.png" alt="Real_captain_3-1728394005350.png" /></span></P><P><BR />We need the output like below :&nbsp;<BR /><BR />1. In tabular form : Is it possible to have an output like below :&nbsp;<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Real_captain_4-1728394466105.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32998i221BC7C8EEFFC50D/image-size/medium?v=v2&amp;px=400" role="button" title="Real_captain_4-1728394466105.png" alt="Real_captain_4-1728394466105.png" /></span></P><P>2. If point 1 is possible to be created , then Is it possible to have a time-chart with 3 lines over the 24 hours of the day . Example of data for 3 hours is attached&nbsp;<BR />1 line corresponds to&nbsp;Week of year -2 (39)<BR />2nd line corresponds to&nbsp;Week of year -1 (40)<BR />3rd line corresponds to&nbsp;Week of year (41)</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Real_captain_5-1728394605105.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32999iEF89594FE944C0BA/image-size/medium?v=v2&amp;px=400" role="button" title="Real_captain_5-1728394605105.png" alt="Real_captain_5-1728394605105.png" /></span></P><P>&nbsp;</P><P><BR /><BR /></P><P>Thanks in advance to help me out.&nbsp;</P><P>&nbsp;</P> Tue, 08 Oct 2024 13:37:50 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701301#M237901 Real_captain 2024-10-08T13:37:50Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701315#M237903 <LI-CODE lang="markup">| stats count as Total by field1 field2 field3 Day Time Week | eval Week_{Week} = Total | stats values(Week_*) as Week_* by field1 field2 field3 Day Time | fillnull value=0 | eval Deviation=2*Week_41/(Week_39+Week_40)</LI-CODE> Tue, 08 Oct 2024 15:28:16 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701315#M237903 ITWhisperer 2024-10-08T15:28:16Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701327#M237905 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR />Thanks for the response.&nbsp;</P> <P>But instead of hard-coading the week number to generate the deviation&nbsp;</P> <LI-CODE lang="markup"> | eval Deviation=2*Week_41/(Week_39+Week_40) the week </LI-CODE> <P>Can we dynamically give the dynamic value of the week as below :&nbsp;<BR /><BR /></P> <LI-CODE lang="markup"> | eval Deviation=2*Week_{current_week}/(Week_{current_week - 1} +Week_{current_week - 2})</LI-CODE> <P><BR />Thanks in advance.&nbsp;</P> Tue, 08 Oct 2024 22:48:05 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701327#M237905 Real_captain 2024-10-08T22:48:05Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701373#M237911 <P>Just re-evaluate Week after the stats command to be current week, current week -1 and current week -2 as appropriate</P> Tue, 08 Oct 2024 22:52:55 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701373#M237911 ITWhisperer 2024-10-08T22:52:55Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701392#M237917 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR />Can you please let me how can I correct the below stats command to&nbsp;<SPAN>re-evaluate Week after the stats command to be current week, current week -1 and current week -2.&nbsp;</SPAN><BR /><BR />| stats count as Total by field1 field2 field3 Day Time Week<BR />| eval Week_{Week} = Total<BR />| stats values(Week_*) as Week_* by field1 field2 field3 Day Time<BR />| fillnull value=0<BR />| eval Deviation=2*<STRONG>Week_41/(Week_39+Week_40)</STRONG></P> Wed, 09 Oct 2024 07:30:01 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701392#M237917 Real_captain 2024-10-09T07:30:01Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701393#M237918 <LI-CODE lang="markup">| stats count as Total by field1 field2 field3 Day Time Week | eventstats max(Week) as ThisWeek | eval Week=if(Week=ThisWeek,"CurrentWeek","CurrentWeek".(Week-ThisWeek)) | eval {Week} = Total | stats values(Current*) as Current* by field1 field2 field3 Day Time | fillnull value=0 | eval Deviation=2*CurrentWeek/('CurrentWeek-2'+'CurrentWeek-1')</LI-CODE> Wed, 09 Oct 2024 09:12:29 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701393#M237918 ITWhisperer 2024-10-09T09:12:29Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701397#M237919 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; : Thanks It worked. You are best <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /><BR />Just a small correction related to the order of columns.<BR />Is it possible to have <STRONG>currentweek-4</STRONG> column first, then&nbsp;<STRONG>currentweek-3 , then&nbsp;currentweek-2&nbsp; , then&nbsp;currentweek-1 and&nbsp;, currentweek in the end before Deviation.&nbsp;<BR /><BR />&nbsp;</STRONG></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Real_captain_1-1728466161262.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33019iDAC63122AA25D97C/image-size/medium?v=v2&amp;px=400" role="button" title="Real_captain_1-1728466161262.png" alt="Real_captain_1-1728466161262.png" /></span></P><P>&nbsp;</P><P><STRONG><BR /><BR /></STRONG></P><P><BR /><BR /><BR /></P> Wed, 09 Oct 2024 09:29:49 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701397#M237919 Real_captain 2024-10-09T09:29:49Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701398#M237920 <P>Just append a table command listing the fields in the order you want them</P> Wed, 09 Oct 2024 09:52:55 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701398#M237920 ITWhisperer 2024-10-09T09:52:55Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701411#M237923 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR />As&nbsp;CurrentWeek* is calculated dynamically , how can i put that field in the table command.&nbsp;<BR />If i use the below table command , it shows me the result in the same order.&nbsp;<BR />How can i reverse the order of the&nbsp;CurrentWeek columns ???&nbsp;<BR /><BR />| table A B C DAY_OF_WEEK Start_Time CurrentWeek*&nbsp;Deviation<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Real_captain_0-1728475312762.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33022i9450FB278D0A172A/image-size/medium?v=v2&amp;px=400" role="button" title="Real_captain_0-1728475312762.png" alt="Real_captain_0-1728475312762.png" /></span></P><P>&nbsp;</P> Wed, 09 Oct 2024 12:02:00 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701411#M237923 Real_captain 2024-10-09T12:02:00Z Re: To compare the value of particular day with the same day of the last week and last to last week. https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701414#M237924 <P>Don't use wildcards or at least not for the -1 -2 -3 part - currently in your screenshot all the names are fixed</P> Wed, 09 Oct 2024 12:21:00 GMT https://community.splunk.com/t5/Splunk-Search/To-compare-the-value-of-particular-day-with-the-same-day-of-the/m-p/701414#M237924 ITWhisperer 2024-10-09T12:21:00Z