How do I compare distinct counts of a given field between two different time ranges within the same Splunk search?

niravshahcorero — Wed, 13 Apr 2016 21:23:08 GMT

I have a CSV file that a list of customers and their orders. The format is as follows:

OrderDate, OrderNumber, Customer, OrderAmount

Same order number can be on multiple lines because a customer can order multiple items under the same order number.
Now, what I want to do is compare the order volume by customer between two years.
Example output:

Customer, 2014 Orders, 2015 Orders, Difference
CustA, 100, 60, -40
CustB, 70, 80, 10
...

I am trying to identify which customers have had a significant decrease in orders and which ones have had a significant increase year over year. I've tried the following but it gives me no search results:

sourcetype="SALESCSV" [search earliest="1/1/2014:00:00:00" latest="12/31/2014:23:59:59" Geography=EMEA search_name="2014 Orders"] [search earliest="1/1/2015:00:00:00" latest="12/31/2015:23:59:59" Geography=EMEA search_name="2015 Orders"] | stats dc(OrderNumber) by search_name

Re: How do I compare distinct counts of a given field between two different time ranges within the same Splunk search?

somesoni2 — Wed, 13 Apr 2016 21:43:39 GMT

Try like this

sourcetype="SALESCSV" earliest="1/1/2014:00:00:00" latest="1/1/2016:00:00:00" Geography=EMEA 
| eval Period=if(_time>=strptime("1/1/2015","%m/%d/%Y"),"2015_Orders","2014_Orders") | chart dc(OrderNumber) over Customer by Period | eval Difference='2014_Orders'-'2015_Orders'

topic Re: How do I compare distinct counts of a given field between two different time ranges within the same Splunk search? in Splunk Search

How do I compare distinct counts of a given field between two different time ranges within the same Splunk search?

Re: How do I compare distinct counts of a given field between two different time ranges within the same Splunk search?