https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228319#M67471 <P>This one the percent doesnt come out right. Am I seeing that correct?</P> Mon, 03 Oct 2016 20:58:40 GMT cbrownlee 2016-10-03T20:58:40Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228316#M67468 <P>I am trying to run a report that runs percentages differences from month to month for each of the severities. I have no idea where to start. </P> <P>| timechart count by Severity </P> <PRE><CODE> Critical Major Minor Warning </CODE></PRE> <P>2016-01 2300 502 1703 6821<BR /> 2016-02 4133 401 1608 7721<BR /> 2016-03 3767 737 1178 1473<BR /> 2016-04 3875 4279 770 16541</P> Mon, 03 Oct 2016 18:17:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228316#M67468 cbrownlee 2016-10-03T18:17:55Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228317#M67469 <P>Try this </P> <PRE><CODE>base search | timechart count by Severity | delta Major as Major_d | delta Minor as Minor_d | delta Warning as Warning_d | eval perc_Major=round((Major-Major_d)/Major*100, 2) | eval perc_Minor=round((Minor -Minor_d)/Minor*100, 2) | eval perc_Warning=round((Warning-Warning_d)/Warning*100, 2) </CODE></PRE> Mon, 03 Oct 2016 18:52:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228317#M67469 sundareshr 2016-10-03T18:52:00Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228318#M67470 <P>Try something like this</P> <PRE><CODE>your base search | bucket span=1mon _time | stats count by Severity _time | streamstats current=f window=1 values(count) as prevcount by Severity | eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2) | timechart span=1mon max(Perc) by Severity </CODE></PRE> Mon, 03 Oct 2016 18:52:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228318#M67470 somesoni2 2016-10-03T18:52:11Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228319#M67471 <P>This one the percent doesnt come out right. Am I seeing that correct?</P> Mon, 03 Oct 2016 20:58:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-timechart-command-to-find-percentage-differences/m-p/228319#M67471 cbrownlee 2016-10-03T20:58:40Z