https://community.splunk.com/t5/Splunk-Search/Single-trend-values-from-day-to-day/m-p/123981#M33485 <P>You can use a timechart to calculate the averages and the streamstats command to calculate a daily ratio:</P> <PRE><CODE> ...| timechart span=1d avg(msecs) AS avg | streamstats current=f global=f window=1 latest(avg) as previous_day_avg | eval ratio=round(avg/previous_day_avg,2) </CODE></PRE> <P>To do it per month use:<BR /> | timechart span=1mon avg(msecs) AS avg</P> Wed, 15 Jul 2015 14:47:56 GMT HeinzWaescher 2015-07-15T14:47:56Z https://community.splunk.com/t5/Splunk-Search/Single-trend-values-from-day-to-day/m-p/123980#M33484 <P>Hi. I want to display two figures of the total avg per day and display from previous day. With showing a percentage in green or red weather its better or worse than the day before...</P> <P>My current search is like </P> <P>......... | bucket _time span=1d | stats avg(msecs) AS Total_avg</P> <P>This displays total average how do I display figures for each month.</P> Tue, 29 Sep 2020 06:41:52 GMT https://community.splunk.com/t5/Splunk-Search/Single-trend-values-from-day-to-day/m-p/123980#M33484 neilhiley 2020-09-29T06:41:52Z https://community.splunk.com/t5/Splunk-Search/Single-trend-values-from-day-to-day/m-p/123981#M33485 <P>You can use a timechart to calculate the averages and the streamstats command to calculate a daily ratio:</P> <PRE><CODE> ...| timechart span=1d avg(msecs) AS avg | streamstats current=f global=f window=1 latest(avg) as previous_day_avg | eval ratio=round(avg/previous_day_avg,2) </CODE></PRE> <P>To do it per month use:<BR /> | timechart span=1mon avg(msecs) AS avg</P> Wed, 15 Jul 2015 14:47:56 GMT https://community.splunk.com/t5/Splunk-Search/Single-trend-values-from-day-to-day/m-p/123981#M33485 HeinzWaescher 2015-07-15T14:47:56Z