https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175386#M50347 <P>Neither of these provide me with 3 columns. which is what I am needing.</P> Wed, 05 Mar 2014 20:53:24 GMT mileven 2014-03-05T20:53:24Z https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175384#M50345 <P>I have the below search. I'm trying to get the % difference between the first count which pulls from a CSV file and the second count which pulls form the splunk server. Yet the final statement doesn't seem to work properly. </P> <PRE><CODE>|Inputlookup PSLSE_Inventory.csv | search AssetEnv=* | chart count AS "Inventory" by AssetEnv| appendcols [search host=* AssetEnv=* | dedup host | chart count AS Reporting by AssetEnv] |appendcols [eval mypercentage = 100 * (count/Reporting) |chart count mypercentage] </CODE></PRE> Wed, 05 Mar 2014 20:24:46 GMT https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175384#M50345 mileven 2014-03-05T20:24:46Z https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175385#M50346 <P>Try this</P> <PRE><CODE>|Inputlookup PSLSE_Inventory.csv | search AssetEnv= | chart count AS Inventory by AssetEnv| appendcols [search host=* AssetEnv=* | dedup host | chart count AS Reporting by AssetEnv] | eval mypercentage=(100*Inventory)/Reporting </CODE></PRE> <P>OR </P> <PRE><CODE>|Inputlookup PSLSE_Inventory.csv | search AssetEnv= | chart count AS Inventory by AssetEnv| join type=left AssetEnv [search host=* AssetEnv=* | dedup host | chart count AS Reporting by AssetEnv] | eval mypercentage=(100*Inventory )/Reporting </CODE></PRE> Wed, 05 Mar 2014 20:46:07 GMT https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175385#M50346 somesoni2 2014-03-05T20:46:07Z https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175386#M50347 <P>Neither of these provide me with 3 columns. which is what I am needing.</P> Wed, 05 Mar 2014 20:53:24 GMT https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175386#M50347 mileven 2014-03-05T20:53:24Z https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175387#M50348 <P>Are you getting two column result with this? How is the value in count field, they come for all the events or some of them are blank</P> <P>|Inputlookup PSLSE_Inventory.csv | search AssetEnv= | chart count AS "Inventory" by AssetEnv| join type=left AssetEnv [search host=* AssetEnv=* | dedup host | chart count AS Reporting by AssetEnv]</P> Wed, 05 Mar 2014 20:55:00 GMT https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175387#M50348 somesoni2 2014-03-05T20:55:00Z https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175388#M50349 <P>also, try updated queries.</P> Wed, 05 Mar 2014 20:57:00 GMT https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175388#M50349 somesoni2 2014-03-05T20:57:00Z https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175389#M50350 <P>I am able to get 2 columns with the values I'm looking for but I would like to get the % difference between the 2.</P> Mon, 10 Mar 2014 17:31:40 GMT https://community.splunk.com/t5/Splunk-Search/finding-the-percent-difference-between-two-searches/m-p/175389#M50350 mileven 2014-03-10T17:31:40Z